CVE-2023-47130

    Dashboard / Vulnerabilities / CVE-2023-47130

    CVE-2023-47130

    Published: 14 Nov 2023Last Modified: 28 Oct 2026

    Summary: Unsafe deserialization of user data in yiisoft/yii

    Details: Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47130.json, https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q, https://nvd.nist.gov/vuln/detail/CVE-2023-47130, https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f89b76ecca1d342e346ebb9bfc1e2c589f696345

    Affected versions

    1.1.28
    1.1.27
    1.1.26
    1.1.25
    1.1.24
    1.1.23
    1.1.22
    1.1.21
    1.1.20
    1.1.19
    1.1.18
    1.1.17
    1.1.14
    1.1.14-rc
    1.1.13
    1.1.13-RC
    1.1.12
    1.1.11
    1.1.10
    1.1.9
    1.1.8
    1.1.7
    1.1.4
    1.1.3
    1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-47130 | CVE-DB