What is the severity of CVE-2017-11516?

CVE-2017-11516 is classified as a moderate severity vulnerability due to its potential for exploitation via cross-site scripting (XSS).

How do I fix CVE-2017-11516?

To fix CVE-2017-11516, upgrade Yii Framework to version 2.0.13 or later.

What specific component is affected in CVE-2017-11516?

CVE-2017-11516 affects the exception handling displayed on the error screen in Yii Framework 2.0.12 when debug mode is enabled.

Can CVE-2017-11516 be exploited remotely?

Yes, CVE-2017-11516 can be exploited remotely if an attacker can trigger error conditions on a vulnerable application.

What impact does CVE-2017-11516 have on users?

If successfully exploited, CVE-2017-11516 can allow attackers to execute arbitrary JavaScript code in the context of the affected user's browser.

Vulnerability/
CVE-2017-11516

medium

6.1

CWE

21/7/2017

17/5/2022

5/8/2024

CVE-2017-11516: XSS

First published: Fri Jul 21 2017(Updated: )

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

Credit: cve@mitre.org cve@mitre.org

Affected Software	Affected Version	How to fix
Yiiframework Yii	=2.0.12
composer/yiisoft/yii2	=2.0.12	2.0.13
composer/yiisoft/yii2-dev	=2.0.12	2.0.13

Remedy

https://github.com/yiisoft/yii2/pull/14492

Remedy

https://github.com/yiisoft/yii2/pull/14492/files/feb4067de8a58f391a66e395192b0d83a8109b95

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2017-11516?
CVE-2017-11516 is classified as a moderate severity vulnerability due to its potential for exploitation via cross-site scripting (XSS).
How do I fix CVE-2017-11516?
To fix CVE-2017-11516, upgrade Yii Framework to version 2.0.13 or later.
What specific component is affected in CVE-2017-11516?
CVE-2017-11516 affects the exception handling displayed on the error screen in Yii Framework 2.0.12 when debug mode is enabled.
Can CVE-2017-11516 be exploited remotely?
Yes, CVE-2017-11516 can be exploited remotely if an attacker can trigger error conditions on a vulnerable application.
What impact does CVE-2017-11516 have on users?
If successfully exploited, CVE-2017-11516 can allow attackers to execute arbitrary JavaScript code in the context of the affected user's browser.

collector/nvd-index
agent/type
agent/remedy
collector/github-advisory-latest
source/GitHub
alias/GHSA-4c64-w8fg-xcq2
alias/CVE-2017-11516
agent/software-canonical-lookup
agent/references
agent/weakness
agent/severity
agent/softwarecombine
agent/description
collector/nvd-cve
source/NVD
agent/author
collector/github-advisory
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/event
agent/first-publish-date
agent/trending
agent/tags
agent/source
vendor/yiiframework
canonical/yiiframework yii
version/yiiframework yii/2.0.12
package-manager/composer

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2017-11516?
CVE-2017-11516 is classified as a moderate severity vulnerability due to its potential for exploitation via cross-site scripting (XSS).
How do I fix CVE-2017-11516?
To fix CVE-2017-11516, upgrade Yii Framework to version 2.0.13 or later.
What specific component is affected in CVE-2017-11516?
CVE-2017-11516 affects the exception handling displayed on the error screen in Yii Framework 2.0.12 when debug mode is enabled.
Can CVE-2017-11516 be exploited remotely?
Yes, CVE-2017-11516 can be exploited remotely if an attacker can trigger error conditions on a vulnerable application.
What impact does CVE-2017-11516 have on users?
If successfully exploited, CVE-2017-11516 can allow attackers to execute arbitrary JavaScript code in the context of the affected user's browser.