CVE-2015-5467: Path Traversal
Published Jul 10, 2015
·Updated
class yii\web\ViewAction allowed to include arbitrary files that end with .php
Other sources
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
Affected Software
4 affected componentsFixes available
composer/yiisoft/yii2-dev<2.0.5
composer/yiisoft/yii2<2.0.5
composer/yiisoft/yii2>=2.0.0<2.0.5
2.0.5
Yiiframework Yii>=2.0.0<2.0.5
Event History
Jul 10, 2015
Advisory Published
06:12 PM
Sep 21, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-5467?
CVE-2015-5467 is classified as a moderate severity vulnerability due to its potential for remote file inclusion.
2
How do I fix CVE-2015-5467?
To mitigate CVE-2015-5467, upgrade Yii to version 2.0.5 or later.
3
What does CVE-2015-5467 allow attackers to do?
CVE-2015-5467 allows attackers to execute any local .php file on the server through a manipulated view parameter.
4
Which versions of Yii are affected by CVE-2015-5467?
CVE-2015-5467 affects all Yii versions prior to 2.0.5.
5
What component is exploited in CVE-2015-5467?
CVE-2015-5467 exploits the yii\web\ViewAction component within the Yii framework.