CVE-2017-11516: Yii Cross-site Scripting Framework vulnerability

May 17, 2022 (updated April 24, 2024)

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

References

github.com/advisories/GHSA-4c64-w8fg-xcq2
github.com/yiisoft/yii2-framework
github.com/yiisoft/yii2/pull/14492
github.com/yiisoft/yii2/pull/14492/files/feb4067de8a58f391a66e395192b0d83a8109b95
nvd.nist.gov/vuln/detail/CVE-2017-11516

Code Behaviors & Features

Detect and mitigate CVE-2017-11516 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →