CVE-2018-6009

Description

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

How to fix CVE-2018-6009

To remediate CVE-2018-6009, upgrade the affected package to a fixed version below.

• Packagist/yiisoft/yii2—upgrade to 2.0.14 or later
• Packagist/yiisoft/yii2-dev—upgrade to 2.0.14 or later

Is CVE-2018-6009 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 2.0, < 2.0.14
• >= 2.0, < 2.0.14

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-6009
• PATCHgithub.com/yiisoft/yii2-framework
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2018-6009.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2018-6009.yaml