CVE-2015-5467: class yii\web\ViewAction allowed to include arbitrary files that end with .php
class yii\web\ViewAction allowed to include arbitrary files that end with .php
Other sources
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/yiisoft/yii2to a version that resolves this vulnerability.Fixed in 2.0.5 - Upgrade
Upgrade
composer/yiisoft/yii2-devto a version that resolves this vulnerability.Fixed in 2.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5467?
CVE-2015-5467 is classified as a moderate severity vulnerability due to its potential for remote file inclusion.
How do I fix CVE-2015-5467?
To mitigate CVE-2015-5467, upgrade Yii to version 2.0.5 or later.
What does CVE-2015-5467 allow attackers to do?
CVE-2015-5467 allows attackers to execute any local .php file on the server through a manipulated view parameter.
Which versions of Yii are affected by CVE-2015-5467?
CVE-2015-5467 affects all Yii versions prior to 2.0.5.
What component is exploited in CVE-2015-5467?
CVE-2015-5467 exploits the yii\web\ViewAction component within the Yii framework.