CVE-2017-11516: XSS
An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11516?
CVE-2017-11516 is classified as a moderate severity vulnerability due to its potential for exploitation via cross-site scripting (XSS).
How do I fix CVE-2017-11516?
To fix CVE-2017-11516, upgrade Yii Framework to version 2.0.13 or later.
What specific component is affected in CVE-2017-11516?
CVE-2017-11516 affects the exception handling displayed on the error screen in Yii Framework 2.0.12 when debug mode is enabled.
Can CVE-2017-11516 be exploited remotely?
Yes, CVE-2017-11516 can be exploited remotely if an attacker can trigger error conditions on a vulnerable application.
What impact does CVE-2017-11516 have on users?
If successfully exploited, CVE-2017-11516 can allow attackers to execute arbitrary JavaScript code in the context of the affected user's browser.