CVE-2017-20158

vova07 Yii2 FileAPI Widget UploadAction.php run cross site scripting

State: Published
Severity: 3.5 Low
Published: Dec 31, 2022
Updated: Aug 5, 2024
Reserved: Dec 31, 2022

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting

Affected Products

Product	Versions
Yii2 FileAPI Widgetvova07	0.1.0Affected 0.1.1Affected 0.1.2Affected 0.1.3Affected 0.1.4Affected 0.1.5Affected 0.1.6Affected 0.1.7Affected 0.1.8Affected

References

https://vuldb.com/?id.217141vdb-entrytechnical-description
https://vuldb.com/?ctiid.217141signaturepermissions-required
https://github.com/vova07/yii2-fileapi-widget/commit/c00d1e4fc912257fca1fce66d7a163bdbb4c8222patch
https://github.com/vova07/yii2-fileapi-widget/releases/tag/0.1.9patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.