CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
References
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:yiiframework:yiiframework:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.0:alpha:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.11:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.11.1:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.11.2:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.12:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.0:rc:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.10:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.13:*:*:*:*:*:*:*

Information

Published : 2018-01-22 14:29

Updated : 2018-02-09 12:16


NVD link : CVE-2018-6009

Mitre link : CVE-2018-6009


JSON object : View

CWE
CWE-352

Cross-Site Request Forgery (CSRF)

Advertisement

dedicated server usa

Products Affected

yiiframework

  • yiiframework