GHSA-74qv-rv53-5wcx

    Dashboard / Vulnerabilities / GHSA-74qv-rv53-5wcx

    GHSA-74qv-rv53-5wcx

    Published: 17 May 2022Last Modified: 7 Dec 2024
    Aliases:
    CVE-2014-4672

    Summary: Yii PHP Framework arbitrary PHP scripts execution

    Details: The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

    References: https://nvd.nist.gov/vuln/detail/CVE-2014-4672, https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii/CVE-2014-4672.yaml, https://github.com/yiisoft/yii, https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix

    Affected packages

    Package

    Name: yiisoft/yii

    Purl: pkg:composer/yiisoft/yii

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 1.1.14
    Fixed -1.1.15

    Affected versions

    1.1.14

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-74qv-rv53-5wcx | CVE-DB