CVE-2022-34297: XSS
Some fields like Message Category (requires I18N enabled) in Model Generator, CRUD Generator or Form Generator, Author Name in Extension Generator, etc. are being cached without sanitisation of their contents when the Preview button is pressed. This leads to possibility of injecting malicious javascript in specified pages by placing it in said fields and caching it by pressing Preview button. On each consequent visit of specified pages malicious javascript will be loaded from server and executed in client's browser.
Other sources
Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-34297?
CVE-2022-34297 is a vulnerability in Yii Yii2 Gii through 2.2.4 that allows stored XSS by injecting a payload into any field.
How severe is CVE-2022-34297?
CVE-2022-34297 has a severity rating of medium with a value of 5.4.
Which software versions are affected by CVE-2022-34297?
The affected software version for CVE-2022-34297 is Yii Yii2 Gii up to and including version 2.2.4.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-34297?
The CWE ID for CVE-2022-34297 is CWE-79.
How can I fix CVE-2022-34297?
To fix CVE-2022-34297, update Yii Yii2 Gii to version 2.2.5 or higher.