Vulnerability Description
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Yii Software | Yii | <= 2.0.10 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/97167
- http://www.yiiframework.com/news/123/yii-2-0-11-is-released/Release NotesVendor Advisory
- https://github.com/yiisoft/yii2/commit/97171a0db7cda0a49931ee0c3b998ef50bd06756
- https://github.com/yiisoft/yii2/pull/13401
- http://www.securityfocus.com/bid/97167
- http://www.yiiframework.com/news/123/yii-2-0-11-is-released/Release NotesVendor Advisory
- https://github.com/yiisoft/yii2/commit/97171a0db7cda0a49931ee0c3b998ef50bd06756
- https://github.com/yiisoft/yii2/pull/13401
FAQ
What is CVE-2017-7271?
CVE-2017-7271 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request dat...
How severe is CVE-2017-7271?
CVE-2017-7271 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-7271?
Check the references section above for vendor advisories and patch information. Affected products include: Yii Software Yii.