| Package | Affected versions | Patched versions |
|---|---|---|
| yiisoft/yii2-dev | ≥ 2.0.0, < 2.0.15 | 2.0.15 |
| yiisoft/yii2-elasticsearch | < 2.0.5 | 2.0.5 |
| yii | ≥ 2.0.0, < 2.0.15 | 2.0.15 |
Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free