CVE-2020-36655

CVSS 8.8 HIGHEPSS 1.5%CWE-94

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

n/a · n/a

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/yiisoft/yii2-gii/issues/433 https://lab.wallarm.com/yii2-gii-remote-code-execution/