p PatchFirst

CVE-2020-15148

CVE-2020-15148 · Unsafe deserialization in Yii 2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

CVSS 8.9 · High · EPSS 77.5% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • yii2

    Versions
    • < 2.0.38: Affected

    No fix published

  • yiisoft/yii2 Packagist

    Versions
    • 2.0.0
    • 2.0.0-alpha
    • 2.0.0-beta
    • 2.0.0-rc
    • 2.0.1
    • 2.0.10
    • 2.0.11
    • 2.0.11.1
    • 2.0.11.2
    • 2.0.12
    • 2.0.12.1
    • 2.0.12.2
    • 2.0.13
    • 2.0.13.1
    • 2.0.13.2
    • 2.0.13.3
    • 2.0.14
    • 2.0.14.1
    • 2.0.14.2
    • 2.0.15
    • 2.0.15.1
    • 2.0.16
    • 2.0.16.1
    • 2.0.17
    • 2.0.18
    • 2.0.19
    • 2.0.2
    • 2.0.20
    • 2.0.21
    • 2.0.22
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.0.28
    • 2.0.29
    • 2.0.3
    • 2.0.30
    • 2.0.31
    • 2.0.32
    • 2.0.33
    • 2.0.34
    • 2.0.35
    • 2.0.36
    • 2.0.37
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    Affected ranges
    • ECOSYSTEM: < 2.0.38

    Update to 2.0.38

Original sources

Check your server →