Vulnerability Description
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Yiiframework | Yii | < 2.0.38 |
Related Weaknesses (CWE)
References
- https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99PatchThird Party Advisory
- https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mjMitigationThird Party Advisory
- https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99PatchThird Party Advisory
- https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mjMitigationThird Party Advisory
FAQ
What is CVE-2020-15148?
CVE-2020-15148 is a vulnerability with a CVSS score of 8.9 (HIGH). Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workarou...
How severe is CVE-2020-15148?
CVE-2020-15148 has been rated HIGH with a CVSS base score of 8.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15148?
Check the references section above for vendor advisories and patch information. Affected products include: Yiiframework Yii.