CVE-2020-15148: Deserialization of Untrusted Data

September 15, 2020 (updated January 7, 2021)

Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

References

github.com/advisories/GHSA-699q-wcff-g9mj
github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99
github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj
nvd.nist.gov/vuln/detail/CVE-2020-15148

Code Behaviors & Features

Detect and mitigate CVE-2020-15148 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →