Lucene search

[email protected]CVE-2018-6010

HistoryJan 22, 2018 - 10:29 p.m.

CVE-2018-6010

2018-01-2222:29:00

CWE-79

[email protected]

web.nvd.nist.gov

yii framework

security

cve-2018-6010

information leak

xss

error handling

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.9%

JSON

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.

Affected configurations

NVD

Node

yiiframeworkyiiframeworkMatch2.0.0

yiiframeworkyiiframeworkMatch2.0.0alpha

yiiframeworkyiiframeworkMatch2.0.0beta

yiiframeworkyiiframeworkMatch2.0.0rc

yiiframeworkyiiframeworkMatch2.0.1

yiiframeworkyiiframeworkMatch2.0.2

yiiframeworkyiiframeworkMatch2.0.3

yiiframeworkyiiframeworkMatch2.0.4

yiiframeworkyiiframeworkMatch2.0.5

yiiframeworkyiiframeworkMatch2.0.6

yiiframeworkyiiframeworkMatch2.0.7

yiiframeworkyiiframeworkMatch2.0.8

yiiframeworkyiiframeworkMatch2.0.9

yiiframeworkyiiframeworkMatch2.0.10

yiiframeworkyiiframeworkMatch2.0.11

yiiframeworkyiiframeworkMatch2.0.11.1

yiiframeworkyiiframeworkMatch2.0.11.2

yiiframeworkyiiframeworkMatch2.0.12

yiiframeworkyiiframeworkMatch2.0.13

yiiframeworkyiiframeworkMatch2.0.13.1

CPENameOperatorVersion
yiiframework:yiiframeworkyiiframeworkeq2.0.0
yiiframework:yiiframeworkyiiframeworkeq2.0.1
yiiframework:yiiframeworkyiiframeworkeq2.0.2
yiiframework:yiiframeworkyiiframeworkeq2.0.3
yiiframework:yiiframeworkyiiframeworkeq2.0.4
yiiframework:yiiframeworkyiiframeworkeq2.0.5
yiiframework:yiiframeworkyiiframeworkeq2.0.6
yiiframework:yiiframeworkyiiframeworkeq2.0.7
yiiframework:yiiframeworkyiiframeworkeq2.0.8
yiiframework:yiiframeworkyiiframeworkeq2.0.9

CPE	Name	Operator	Version
yiiframework:yiiframework	yiiframework	eq	2.0.0
yiiframework:yiiframework	yiiframework	eq	2.0.1
yiiframework:yiiframework	yiiframework	eq	2.0.2
yiiframework:yiiframework	yiiframework	eq	2.0.3
yiiframework:yiiframework	yiiframework	eq	2.0.4
yiiframework:yiiframework	yiiframework	eq	2.0.5
yiiframework:yiiframework	yiiframework	eq	2.0.6
yiiframework:yiiframework	yiiframework	eq	2.0.7
yiiframework:yiiframework	yiiframework	eq	2.0.8
yiiframework:yiiframework	yiiframework	eq	2.0.9

Rows per page:

1-10 of 171

References

github.com/yiisoft/yii2/commit/6b0be47e0fa9c532e03b07b4369050582fcf5c7a

github.com/yiisoft/yii2/issues/14711

github.com/yiisoft/yii2/pull/15534

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.9%

JSON

Related for CVE-2018-6010

github1 friendsofphp2 prion1 osv2 cvelist1 nvd1