CVE-2017-7271 | BDVDB-2026-83282 Detail

Description#

Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.yiiframework.com/news/123/yii-2-0-11-is-released/
https://github.com/yiisoft/yii2/commit/97171a0db7cda0a49931ee0c3b998ef50bd06756
http://www.securityfocus.com/bid/97167
https://github.com/yiisoft/yii2/pull/13401

Exploit#

No public exploit known

History#

Version 12017-03-27Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.