CVE-2020-15148 — Unsafe deserialization in Yii 2
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.…
Published: 2020-09-15 · CVSS: 8.9 · CVSS 3.1
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7