CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-50714 – The Oauth2 PKCE implementation is vulnerable
https://notcve.org/view.php?id=CVE-2023-50714
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. • https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213 https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5 • CWE-287: Improper Authentication CWE-347: Improper Verification of Cryptographic Signature CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-50708 – yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
https://notcve.org/view.php?id=CVE-2023-50708
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available. yii2-authclient es una extensión que agrega consumidores OpenID, OAuth, OAuth2 y OpenId Connect para el framework Yii 2.0. En yii2-authclient antes de la versión 2.2.15, el `state` de Oauth1/2 y el `nonce` de OpenID Connect son vulnerables a un `ataque de sincronización` ya que se compara mediante una comparación de cadenas regular (en lugar de `Yii::$app- >getSecurity()->compareString()`). • https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248 https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp • CWE-203: Observable Discrepancy •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47130 – Unsafe deserialization of user data in yiisoft/yii
https://notcve.org/view.php?id=CVE-2023-47130
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06 https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5467
https://notcve.org/view.php?id=CVE-2015-5467
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter. web\ViewAction en Yii (también conocido como Yii2) 2.x anterior a 2.0.5 permite a los atacantes ejecutar cualquier archivo .php local a través de una ruta relativa en el parámetro de vista. • https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2015-5467.yaml https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31454
https://notcve.org/view.php?id=CVE-2022-31454
Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2. Se ha descubierto que Yii 2 v2.0.45 contiene una vulnerabilidad Cross-Site Scripting (XSS) a través del endpoint "/books". • https://medium.com/%40rohitgautam26/cve-2022-31454-8e8555c31fd3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •