CVE-2017-7271 Yii Framework Reflected XSS
Remote attackers can inject arbitrary web script via crafted requests in Yii Framework's debug-mode exception screen when development mode is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-7271?
CVE-2017-7271 is a medium-severity cross-site scripting vulnerability in n/a, published on 27 Mar 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
Weakness: CWE-79
Which versions are affected by CVE-2017-7271?
2 open source packages ship an affected version, including yiisoft/yii2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yiisoft/yii2 Packagist | All versions | 2.0.11 |
yiisoft/yii2 Packagist | All versions | 2.0.11 |
Products include Yii Software Yii.
How do I fix CVE-2017-7271?
Upgrade yiisoft/yii2 to 2.0.11 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-7271 being exploited?
There is no known exploitation of CVE-2017-7271 in the wild and no public exploit code.
Sources
Also known as CVE-2017-1000041, GHSA-4xh9-5vh8-3p58.