Detections
Analytics
SCA: security update for vova07/yii2-fileapi-widget (GHSA-j82x-fh8h-326g)
medium Tenable Cloud Security Plugin ID 416225
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It
has been declared as problematic. Affected by this vulnerability is the function run of the file
actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack
can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the
patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component.
The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects
products that are no longer supported by the maintainer. (CVE-2017-20158)
See Also
Plugin Details
Severity: Medium
ID: 416225
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 8.67
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2017-20158
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 12/31/2022
Vulnerability Publication Date: 12/31/2022
Reference Information
CVE: CVE-2017-20158
cwe: CWE-79