CVE-2018-6009
22.01.2018, 22:29
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
CSRF
| Vendor | Product | Version |
|---|---|---|
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.1 |
| yiiframework | yiiframework | 2.0.2 |
| yiiframework | yiiframework | 2.0.3 |
| yiiframework | yiiframework | 2.0.4 |
| yiiframework | yiiframework | 2.0.5 |
| yiiframework | yiiframework | 2.0.6 |
| yiiframework | yiiframework | 2.0.7 |
| yiiframework | yiiframework | 2.0.8 |
| yiiframework | yiiframework | 2.0.9 |
| yiiframework | yiiframework | 2.0.10 |
| yiiframework | yiiframework | 2.0.11 |
| yiiframework | yiiframework | 2.0.11.1 |
| yiiframework | yiiframework | 2.0.11.2 |
| yiiframework | yiiframework | 2.0.12 |
| yiiframework | yiiframework | 2.0.13 |
| yiiframework | yiiframework | 2.0.13.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration