Reflected Cross-site Scripting Affecting yiisoft/yii2 package, versions >=2.0.49.3, <2.0.50
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-YIISOFTYII2-7172127
- published 31 May 2024
- disclosed 30 May 2024
- credit Antiphishing
Introduced: 30 May 2024
New CVE-2024-32877 Open this link in a new tabHow to fix?
Upgrade yiisoft/yii2 to version 2.0.50 or higher.
Overview
yiisoft/yii2 is a Yii PHP Framework.
Affected versions of this package are vulnerable to Reflected Cross-site Scripting through the mechanism for displaying function argument values in the stack trace. An attacker can execute arbitrary JavaScript code in the security context of the victim's site by crafting a link that manipulates the title attribute of a span tag to include malicious JavaScript through event handlers such as onmousemove.
Note:
For this vulnerability to be exploited, the following requirements must be met:
The framework is in debug mode (
YII_DEBUGset totrue);The
php.inisettingzend.exception_ignore_argsis set toOff(default value);An attacker induces an exception in the application, leading to a stack trace page being displayed.