Lucene search

GoogleOSV:CVE-2022-41922

HistoryNov 23, 2022 - 6:15 p.m.

CVE-2022-41922

2022-11-2318:15:12

Google

osv.dev

cve-2022-41922

remote code execution

patched

unserialize

yiisoft yii

9.7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.7%

JSON

yiisoft/yii before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input. This has been patched in 1.1.27.

CPENameOperatorVersion
yiieq1.1.19
yiieq1.1.15
yiieq1.1.22
yiieq1.1.24
yiieq1.1.3
yiieq1.1.8
yiieq1.1.21
yiieq1.1rc
yiieq1.1.7
yiieq1.1.13-RC

Name	Operator	Version
yii	eq	1.1.19
yii	eq	1.1.15
yii	eq	1.1.22
yii	eq	1.1.24
yii	eq	1.1.3
yii	eq	1.1.8
yii	eq	1.1.21
yii	eq	1.1rc
yii	eq	1.1.7
yii	eq	1.1.13-RC

Rows per page:

1-10 of 291

References

github.com/yiisoft/yii/commit/ed67b7cc57216557c5c595c6650cdd2d3aa41c52

github.com/yiisoft/yii/security/advisories/GHSA-442f-wcwq-fpcf