CVE-2018-20745

MEDIUM

Yii 2.x through 2.0.15.1 - Origin Validation Error in CORS Policy Handling

Title source: llm
STIX 2.1

Description

Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

References (2)

Core 2
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/yiisoft/yii2/issues/16193

Scores

CVSS v3 5.9
EPSS 0.0054
EPSS Percentile 41.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-346
Status published
Products (2)
yiiframework/yii 2.0 - 2.0.15.1
yiisoft/yii2 0 - 2.0.16Packagist
Published Jan 28, 2019
Tracked Since Feb 18, 2026