Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.
References
Link | Resource |
---|---|
https://github.com/yiisoft/yii2-gii/issues/433 | Exploit Issue Tracking Third Party Advisory |
https://lab.wallarm.com/yii2-gii-remote-code-execution/ | Exploit Mitigation Third Party Advisory |
Configurations
History
30 Jan 2023, 16:45
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-94 | |
CPE | cpe:2.3:a:yiiframework:gii:*:*:*:*:*:yii2:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
First Time |
Yiiframework
Yiiframework gii |
|
References | (MISC) https://lab.wallarm.com/yii2-gii-remote-code-execution/ - Exploit, Mitigation, Third Party Advisory | |
References | (MISC) https://github.com/yiisoft/yii2-gii/issues/433 - Exploit, Issue Tracking, Third Party Advisory |
21 Jan 2023, 01:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-01-21 01:15
Updated : 2023-12-10 14:48
NVD link : CVE-2020-36655
Mitre link : CVE-2020-36655
CVE.ORG link : CVE-2020-36655
JSON object : View
Products Affected
yiiframework
- gii
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')