CVE-2017-11516: XSS

Published Jul 21, 2017

Updated

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

Affected Software

3 affected componentsFixes available

composer/yiisoft/yii2=2.0.12

2.0.13

composer/yiisoft/yii2-dev=2.0.12

2.0.13

Yiiframework Yii=2.0.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/yiisoft/yii2 to a version that resolves this vulnerability.
Fixed in 2.0.13
Upgrade
Upgrade composer/yiisoft/yii2-dev to a version that resolves this vulnerability.
Fixed in 2.0.13

Event History

Jul 21, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

May 17, 2022

Advisory Published

via GitHub·02:26 AM

Frequently Asked Questions

What is the severity of CVE-2017-11516?

CVE-2017-11516 is classified as a moderate severity vulnerability due to its potential for exploitation via cross-site scripting (XSS).

How do I fix CVE-2017-11516?

To fix CVE-2017-11516, upgrade Yii Framework to version 2.0.13 or later.

What specific component is affected in CVE-2017-11516?

CVE-2017-11516 affects the exception handling displayed on the error screen in Yii Framework 2.0.12 when debug mode is enabled.

Can CVE-2017-11516 be exploited remotely?

Yes, CVE-2017-11516 can be exploited remotely if an attacker can trigger error conditions on a vulnerable application.

What impact does CVE-2017-11516 have on users?

If successfully exploited, CVE-2017-11516 can allow attackers to execute arbitrary JavaScript code in the context of the affected user's browser.