GHSA-gq63-p39p-jrjf

Source

https://github.com/advisories/GHSA-gq63-p39p-jrjf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-gq63-p39p-jrjf/GHSA-gq63-p39p-jrjf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gq63-p39p-jrjf

Withdrawn

2023-08-14T20:34:10Z

Published

2023-04-04T15:30:27Z

Modified

2025-02-13T19:10:45.806737Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Withdrawn: SQL injection in Yii 2

Details

Withdrawn Advisory

This advisory has been withdrawn because the issue originates from a product built on Yii2, not the Yii2 Framework itself. This link is maintained to preserve external references.

Original Description

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function.

Database specific

{
    "nvd_published_at": "2023-04-04T15:15:00Z",
    "cwe_ids": [
        "CWE-79",
        "CWE-89"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T17:25:59Z"
}

References

Affected packages

Packagist / yiisoft/yii2

Package

Name: yiisoft/yii2
Purl: pkg:composer/yiisoft/yii2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.47

Affected versions

2.*

2.0.0-alpha

2.0.0-beta

2.0.0-rc

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.11.1

2.0.11.2

2.0.12

2.0.12.1

2.0.12.2

2.0.13

2.0.13.1

2.0.13.2

2.0.13.3

2.0.14

2.0.14.1

2.0.14.2

2.0.15

2.0.15.1

2.0.16

2.0.16.1

2.0.17

2.0.18

2.0.19

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

2.0.37

2.0.38

2.0.39

2.0.39.1

2.0.39.2

2.0.39.3

2.0.40

2.0.41

2.0.41.1

2.0.42

2.0.42.1

2.0.43

2.0.44

2.0.45

2.0.46