CVE-2018-6010: XSS
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
Other sources
Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/yiisoft/yii2to a version that resolves this vulnerability.Fixed in 2.0.14 - Upgrade
Upgrade
Yii Framework 2.xto a version that resolves this vulnerability.Fixed in 2.0.14 - Configuration
Ensure the error handler does not print potentially sensitive exception message details in non-debug mode; apply the Yii Framework 2.x fix affecting base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php (upgrading to 2.0.14).
Yii Framework base/ErrorHandler.php / log/Dispatcher.php / views/errorHandler/exception.php debug (non-debug mode) = true
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6010?
The severity of CVE-2018-6010 is high with a CVSS score of 7.5.
How can remote attackers exploit CVE-2018-6010?
Remote attackers can obtain potentially sensitive information from exception messages or exploit reflected XSS on the error handler page in non-debug mode.
What software versions are affected by CVE-2018-6010?
Yii Framework 2.x before 2.0.14 is affected by CVE-2018-6010.
Are there any fixes available for CVE-2018-6010?
Yes, upgrading to Yii Framework 2.0.14 will fix CVE-2018-6010.
Where can I find more information about CVE-2018-6010?
More information about CVE-2018-6010 can be found at the Yii Framework website and the GitHub repository.