CVE-2015-3397: XSS
Published May 10, 2015
·Updated
Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.
Other sources
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
Affected Software
7 affected componentsFixes available
composer/yiisoft/yii2<2.0.4
composer/yiisoft/yii2-bootstrap<2.0.4
composer/yiisoft/yii2-jui<2.0.4
composer/yiisoft/yii2-gii<2.0.4
composer/yiisoft/yii2-dev<2.0.4
composer/yiisoft/yii2<2.0.4
2.0.4
Yiiframework Yiiframework<=2.0.3
Remediation
Patch Available
Event History
May 10, 2015
Advisory Published
03:38 AM
May 14, 2015
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3397?
CVE-2015-3397 is categorized as a high severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2015-3397?
To fix CVE-2015-3397, upgrade to Yii Framework version 2.0.4 or later.
3
Which versions of Yii Framework are affected by CVE-2015-3397?
CVE-2015-3397 affects all versions of Yii Framework prior to 2.0.4.
4
What types of attacks can exploit CVE-2015-3397?
CVE-2015-3397 can be exploited to perform XSS attacks by injecting arbitrary web scripts or HTML.
5
Are older browsers specifically vulnerable to CVE-2015-3397?
Yes, CVE-2015-3397 particularly affects Internet Explorer versions 6 and 7, making them more susceptible to XSS attacks.