CVE-2020-15148 Unsafe deserialization in Yii 2
Remote code execution is possible in the Yii 2 framework if applications unsafely deserialize arbitrary user input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15148?
CVE-2020-15148 is a high-severity unsafe deserialization vulnerability in yiisoft yii2, published on 15 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Weakness: CWE-502
Which versions are affected by CVE-2020-15148?
2 open source packages ship an affected version, including yiisoft/yii2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yiisoft/yii2 Packagist | All versions | 2.0.38 |
yiisoft/yii2 Packagist | All versions | 2.0.38 |
Products include Yiiframework Yii.
How do I fix CVE-2020-15148?
Upgrade yiisoft/yii2 to 2.0.38 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-15148 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-15148 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in yiisoft yii2
- CVE-2024-58136 Yiiframework Yii Improper Protection of Alternate Path
- CVE-2015-5467 Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
- CVE-2023-26750 SQL injection in n/a
- CVE-2018-7269 Yii SQL injection vulnerability
- CVE-2018-8073 yii2-redis Potential Remote code execution
Sources
Also known as GHSA-699q-wcff-g9mj.