CVE-2014-4672: Code Injection

Q: What is the severity of CVE-2014-4672?

CVE-2014-4672 is considered a critical vulnerability due to its ability to allow remote code execution on affected systems.

Q: How do I fix CVE-2014-4672?

To fix CVE-2014-4672, upgrade the Yii PHP Framework to version 1.1.15 or later.

Q: Which versions of Yii Framework are affected by CVE-2014-4672?

CVE-2014-4672 affects Yii Framework version 1.1.14 and all versions up to, but not including, 1.1.15.

Q: What types of attacks can exploit CVE-2014-4672?

CVE-2014-4672 can be exploited by remote attackers to execute arbitrary PHP scripts on the server.

Q: Is CVE-2014-4672 a known vulnerability?

Yes, CVE-2014-4672 was publicly disclosed and has known exploits that target vulnerable versions of Yii.

Published Jun 30, 2014

Updated

The CDetailView widget allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property

Other sources

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

Affected Software

3 affected componentsFixes available

composer/yiisoft/yii>=1.1.14, <1.1.15

composer/yiisoft/yii>=1.1.14<1.1.15

1.1.15

Yiiframework Yiiframework=1.1.14

Event History

Jun 30, 2014

Advisory Published

07:15 AM

Jul 3, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4672?

CVE-2014-4672 is considered a critical vulnerability due to its ability to allow remote code execution on affected systems.

How do I fix CVE-2014-4672?

To fix CVE-2014-4672, upgrade the Yii PHP Framework to version 1.1.15 or later.

Which versions of Yii Framework are affected by CVE-2014-4672?

CVE-2014-4672 affects Yii Framework version 1.1.14 and all versions up to, but not including, 1.1.15.

What types of attacks can exploit CVE-2014-4672?