{"id":"GHSA-4c64-w8fg-xcq2","aliases":["CVE-2017-11516"],"title":"Yii Cross-site Scripting Framework vulnerability","description":"An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.","severity":"medium","score":6.1,"published":"2022-05-17T02:26:08.000Z","modified":"2024-04-24T18:57:22.032Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"yiisoft/yii2-dev","ranges":[{"events":[{"introduced":"2.0.12"},{"fixed":"2.0.13"}],"type":"ECOSYSTEM"}],"versions":["2.0.12","2.0.12.1","2.0.12.2"],"fixed":["2.0.13"]},{"ecosystem":"Packagist","name":"yiisoft/yii2","ranges":[{"events":[{"introduced":"2.0.12"},{"fixed":"2.0.13"}],"type":"ECOSYSTEM"}],"versions":["2.0.12","2.0.12.1","2.0.12.2"],"fixed":["2.0.13"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-11516","https://github.com/yiisoft/yii2/pull/14492","https://github.com/yiisoft/yii2/pull/14492/files/feb4067de8a58f391a66e395192b0d83a8109b95","https://github.com/yiisoft/yii2-framework"],"sources":[{"name":"OSV","id":"GHSA-4c64-w8fg-xcq2","modified":"2024-04-24T18:57:22.032315Z","url":"https://osv.dev/vulnerability/GHSA-4c64-w8fg-xcq2"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}