CVE-2020-36655

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-36655

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36655.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-36655

Aliases

GHSA-3mpg-q26j-83j5

Published

2023-01-21T01:15:12.343Z

Modified

2026-03-14T10:30:13.704780Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

References

Affected packages

Git / github.com/yiisoft/yii2-gii

Affected ranges

Type

GIT

Repo

https://github.com/yiisoft/yii2-gii

Events

Introduced

Fixed

68efc6fb830feccfaa43354817b5bcd36c7bd5a8

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.2"
        }
    ]
}

Affected versions

2.*

2.0.0

2.0.0-beta

2.0.0-rc

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.2.0

2.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36655.json"