CVE-2017-11516 Yii Cross-site Scripting Framework vulnerability

What is CVE-2017-11516?

CVE-2017-11516 is a medium-severity cross-site scripting vulnerability in n/a, published on 21 Jul 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

Weakness: CWE-79

Which versions are affected by CVE-2017-11516?

4 open source packages ship an affected version, including yiisoft/yii2 and yiisoft/yii2-dev. It affects 1 product.

Products include Yiiframework Yii.

How do I fix CVE-2017-11516?

Upgrade yiisoft/yii2 to 2.0.13 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-11516 being exploited?

There is no known exploitation of CVE-2017-11516 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-58136 Yiiframework Yii Improper Protection of Alternate Path Exploited Critical 9.0
• CVE-2015-5467 Yii2 allows attackers to execute any local .php file via a relative path in the view parameter Critical 9.8
• CVE-2023-26750 SQL injection in n/a Critical 9.8
• CVE-2018-7269 Yii SQL injection vulnerability Critical 9.8
• CVE-2018-8073 yii2-redis Potential Remote code execution Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4c64-w8fg-xcq2.