Detections
Analytics

SCA: security update for yiisoft/yii2 (GHSA-qg5r-95m4-mjgj)

medium Tenable Cloud Security Plugin ID 418110

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2,
 users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is
 relevant for the latest version of Yii2 (2.0.49.3). This issue lies in the mechanism for displaying
 function argument values in the stack trace. The vulnerability manifests when an argument's value exceeds
 32 characters. For convenience, argument values exceeding this limit are truncated and displayed with an
 added "...". The full argument value becomes visible when hovering over it with the mouse, as it is
 displayed in the title attribute of a span tag. However, the use of a double quote (") allows an attacker
 to break out of the title attribute's value context and inject their own attributes into the span tag,
 including malicious JavaScript code through event handlers such as onmousemove. This vulnerability allows
 an attacker to execute arbitrary JavaScript code in the security context of the victim's site via a
 specially crafted link. This could lead to the theft of cookies (including httpOnly cookies, which are
 accessible on the page), content substitution, or complete takeover of user accounts. This issue has been
 addressed in version 2.0.50. Users are advised to upgrade. There are no known workarounds for this
 vulnerability. (CVE-2024-32877)

See Also

https://github.com/advisories/GHSA-qg5r-95m4-mjgj

Plugin Details

Severity: Medium

ID: 418110

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2024-32877

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/2/2024

Vulnerability Publication Date: 5/30/2024

Reference Information

CVE: CVE-2024-32877

cwe: CWE-79