Kurz gesagt
- CVE-2023-47130 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in yiisoft/yii, yii (yiiframework).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.1%, höher als bei 87.9% aller Schwachstellen.
- Abhilfe: auf 1.1.29 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| yiisoft/yii Packagist | < 1.1.29
| 1.1.29
|
| yii | < 1.1.29
| 1.1.29
|
Description
Impact
Affected versions of yiisoft/yii are vulnerable to Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input.
Patches
Upgrade yiisoft/yii to version 1.1.29 or higher.
For more information
See the following links for more details:
If you have any questions or comments about this advisory, contact us through security form.
NVD description
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free