CVE-2018-6010
22.01.2018, 22:29
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
Cross-site Scripting
| Vendor | Product | Version |
|---|---|---|
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.0 |
| yiiframework | yiiframework | 2.0.1 |
| yiiframework | yiiframework | 2.0.2 |
| yiiframework | yiiframework | 2.0.3 |
| yiiframework | yiiframework | 2.0.4 |
| yiiframework | yiiframework | 2.0.5 |
| yiiframework | yiiframework | 2.0.6 |
| yiiframework | yiiframework | 2.0.7 |
| yiiframework | yiiframework | 2.0.8 |
| yiiframework | yiiframework | 2.0.9 |
| yiiframework | yiiframework | 2.0.10 |
| yiiframework | yiiframework | 2.0.11 |
| yiiframework | yiiframework | 2.0.11.1 |
| yiiframework | yiiframework | 2.0.11.2 |
| yiiframework | yiiframework | 2.0.12 |
| yiiframework | yiiframework | 2.0.13 |
| yiiframework | yiiframework | 2.0.13.1 |
𝑥
= Vulnerable software versions
References