CVE-2023-47130

CRITICAL EPSS 86.3%
Published Nov 14, 20232y ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Nov 14, 2023 2y ago
Last Modified Jun 17, 2026 1w ago

Description

Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
86.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

VendorProductVersionRange
yiiframeworkyii* <1.1.29

References 3

  • github.com https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06
    Patch
  • github.com https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q
    Patch
  • owasp.org https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
    Third Party Advisory

Remediation

  • github.com https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06
    Patch
  • github.com https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q
    Patch