yiisoft/yii deserializing untrusted user input can lead to remote code execution

緊急 9.8CVE-2023-47130 · GHSA-mw2w-2hj2-fg8q · 14/11/2023 公開 · 17/06/2026 更新

要点

CVE-2023-47130 は yiisoft/yii, yii (yiiframework) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.1%（全脆弱性の 87.9% より高い）。
対処：1.1.29 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
yiisoft/yii Packagist	`< 1.1.29`	`1.1.29`
yii yiiframework	`< 1.1.29`	`1.1.29`

概要

Impact

Affected versions of yiisoft/yii are vulnerable to Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input.

Patches

Upgrade yiisoft/yii to version 1.1.29 or higher.

For more information

See the following links for more details:

If you have any questions or comments about this advisory, contact us through security form.

NVD の説明

Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.