Yii2 FileAPI Widget vulnerable to Cross-site Scripting

MEDIUM 6.1CVE-2017-20158 · GHSA-j82x-fh8h-326g · Published 31/12/2022 · updated 17/06/2026

In short

CVE-2017-20158 is a MEDIUM (CVSS 6.1) vulnerability affecting vova07/yii2-fileapi-widget, yii2 fileapi widget (yii2 fileapi widget project).
Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 48.7% of all vulnerabilities.
Fix: update to 0.1.9 or later.

Package	Affected versions	Patched versions
vova07/yii2-fileapi-widget Packagist	`< 0.1.9`	`0.1.9`
yii2 fileapi widget yii2_fileapi_widget_project	`< 0.1.9`	`0.1.9`

Description

A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 can address this issue. The name of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NVD description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

nvd.nist.gov/vuln/detail/CVE-2017-20158 · ADVISORY
vova07/yii2-fileapi-widget commit c00d1e4 · WEB
vova07/yii2-fileapi-widget · PACKAGE
vova07/yii2-fileapi-widget release 0.1.9 · WEB
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

vova07/yii2-fileapi-widget

Packagist

< 0.1.9

0.1.9

yii2 fileapi widget

yii2_fileapi_widget_project

< 0.1.9

0.1.9

Description

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NVD description