CVE-2018-20745 | BDVDB-2026-112279 Detail

Description#

Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf
https://github.com/yiisoft/yii2/issues/16193

Exploit#

No public exploit known

History#

Version 12019-01-28Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.