CVE-2022-34297: Yii2 Gii Cross-site Scripting vulnerability

December 10, 2022 (updated April 23, 2025)

Some fields like Message Category (requires I18N enabled) in Model Generator, CRUD Generator or Form Generator, Author Name in Extension Generator, etc. are being cached without sanitisation of their contents when the Preview button is pressed. This leads to possibility of injecting malicious javascript in specified pages by placing it in said fields and caching it by pressing Preview button. On each consequent visit of specified pages malicious javascript will be loaded from server and executed in client’s browser.

References

gist.github.com/be4r/b5c48d97ef6726d3ee37f995ee5aac81
github.com/advisories/GHSA-x87m-36g7-6mpw
github.com/yiisoft/yii2-gii
nvd.nist.gov/vuln/detail/CVE-2022-34297
www.yiiframework.com/doc/guide/2.0/en/start-gii

Code Behaviors & Features

Detect and mitigate CVE-2022-34297 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →