CVE-2018-6009

Published January 22nd, 2018

View on NVD ↗

CVSS v3

N/A

CVSS v2

6.8

MEDIUM

Affected

1

PROJECT

Description

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

Yii 2: The Fast, Secure and Professional PHP Framework

GitHub

14.3K