CVE-2014-4672
Yii PHP Framework arbitrary PHP scripts execution
EPSS 2.1%
Description
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
How to fix CVE-2014-4672
To remediate CVE-2014-4672, upgrade the affected package to a fixed version below.
- Packagist/yiisoft/yii—upgrade to 1.1.15 or later
Is CVE-2014-4672 being exploited?
Low — EPSS is 2.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 1.1.14, < 1.1.15