Arbitrary Code Execution

2024-06-0506:26:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

yii2

vulnerability

improper validation

magic function

attaching behaviors

6.7 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

yiisoft/yii2 is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper validation in the __set() magic function when attaching behaviors to components, allowing instantiation of arbitrary classes if attacker-controlled input is provided.