CVE-2018-6010

Published: Jan 22, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.

Affected (20)

Products: Yiiframework: Yiiframework

Yiiframework

1 product

Yiiframework

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Yiiframework Yiiframework	Version 2.0.0
Yiiframework Yiiframework	Version 2.0.0 alpha
Yiiframework Yiiframework	Version 2.0.0 beta
Yiiframework Yiiframework	Version 2.0.0 rc
Yiiframework Yiiframework	Version 2.0.10
Yiiframework Yiiframework	Version 2.0.11.1
Yiiframework Yiiframework	Version 2.0.11.2
Yiiframework Yiiframework	Version 2.0.11
Yiiframework Yiiframework	Version 2.0.12
Yiiframework Yiiframework	Version 2.0.13.1
Yiiframework Yiiframework	Version 2.0.13
Yiiframework Yiiframework	Version 2.0.1
Yiiframework Yiiframework	Version 2.0.2
Yiiframework Yiiframework	Version 2.0.3
Yiiframework Yiiframework	Version 2.0.4
Yiiframework Yiiframework	Version 2.0.5
Yiiframework Yiiframework	Version 2.0.6
Yiiframework Yiiframework	Version 2.0.7
Yiiframework Yiiframework	Version 2.0.8
Yiiframework Yiiframework	Version 2.0.9