CVE-2018-6009: CSRF
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
Other sources
The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/yiisoft/yii2-devto a version that resolves this vulnerability.Fixed in 2.0.14 - Upgrade
Upgrade
composer/yiisoft/yii2to a version that resolves this vulnerability.Fixed in 2.0.14
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-6009.
What is the severity of CVE-2018-6009?
CVE-2018-6009 has a severity value of 8.8 (high).
What software versions are affected by CVE-2018-6009?
CVE-2018-6009 affects Yii Framework versions up to and including 2.0.14.
How does the switchIdentity() function in yii\web\User introduce the vulnerability?
The switchIdentity() function in yii\web\User does not regenerate the CSRF token upon a change of identity, which introduces the vulnerability.
How can I fix CVE-2018-6009?
To fix CVE-2018-6009, upgrade to Yii Framework version 2.0.14 or higher.