CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
References
Configurations

Configuration 1

cpe:2.3:a:yiiframework:yiiframework:2.0.0:alpha:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.0:rc:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.10:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.11:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.11.1:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.11.2:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.12:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.13:*:*:*:*:*:*:*
cpe:2.3:a:yiiframework:yiiframework:2.0.13.1:*:*:*:*:*:*:*

Information

Published : 2018-01-22 10:29

Updated : 2018-02-09 08:16


NVD link : CVE-2018-6009

Mitre link : CVE-2018-6009

Products Affected
No products.
CWE