Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2020-36655

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

VectorNETWORK

PublishedJan 21, 2023, 01:15

Published Bycve@mitre.org

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

yiisoft/yii2-gii(Packagist)02.2.2N/A

References

https://github.com/yiisoft/yii2-gii/issues/433
https://lab.wallarm.com/yii2-gii-remote-code-execution/

Weakness Type

CWE-94

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK