Lucene search

Veracode Vulnerability DatabaseVERACODE:47357

HistoryJun 05, 2024 - 6:04 a.m.

Cross-Site Scripting (XSS)

2024-06-0506:04:46

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

xss

vulnerability

yiisoft/yii2

htmlspecialchars

injection

exception

4.2 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

yiisoft/yii2 is vulnerable to Cross-site Scripting (XSS). The vulnerability is caused by improper handling of quote conversion in the htmlspecialchars function, allowing an attacker to inject malicious attributes though argument values in exception stack traces.

CPENameOperatorVersion
yiisoft/yii2le2.0.49.3
yiisoft/yii2le2.0.49.3

CPE	Name	Operator	Version
	yiisoft/yii2	le	2.0.49.3
	yiisoft/yii2	le	2.0.49.3

References

github.com/advisories/GHSA-qg5r-95m4-mjgj

github.com/yiisoft/yii2/commit/f7baab16e79f2369d4838ab5653c3c07ecf26615

github.com/yiisoft/yii2/security/advisories/GHSA-qg5r-95m4-mjgj

4.2 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VERACODE:47357