{"id":"GHSA-w2xx-jp9f-gp8g","aliases":["CVE-2015-3397"],"title":"Yii Framework Cross-site Scripting Vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.","severity":"medium","score":null,"published":"2022-05-17T03:30:00.000Z","modified":"2024-11-30T05:44:00.081Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"yiisoft/yii2","sources":[{"name":"OSV · GHSA-w2xx-jp9f-gp8g","url":"https://osv.dev/vulnerability/GHSA-w2xx-jp9f-gp8g"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.0.4"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.0-alpha","2.0.0-beta","2.0.0-rc","2.0.1","2.0.2","2.0.3"],"fixed":["2.0.4"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-3397","https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2015-3397.yaml","https://github.com/yiisoft/yii2/blob/2.0.4/framework/CHANGELOG.md","https://web.archive.org/web/20210122155403/http://www.securityfocus.com/bid/74663","https://www.yiiframework.com/news/86/yii-2-0-4-is-released","http://www.securityfocus.com/bid/74663","http://www.yiiframework.com/news/86/yii-2-0-4-is-released"],"sources":[{"name":"OSV","id":"GHSA-w2xx-jp9f-gp8g","modified":"2024-11-30T05:44:00.081747Z","url":"https://osv.dev/vulnerability/GHSA-w2xx-jp9f-gp8g"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:50:33.295Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}