CVE-2024-32877

Packagist/yiisoft/yii2 CVE-2024-32877: medium 4.2, EPSS 0.35%

Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

Action: Upgrade yiisoft/yii2 to 2.0.49.4 or later.

composer require yiisoft/yii2:2.0.49.4

Affected

Fixed versions

Sources

• osv: GHSA-qg5r-95m4-mjgj
• https://github.com/yiisoft/yii2/security/advisories/GHSA-qg5r-95m4-mjgj
• https://nvd.nist.gov/vuln/detail/CVE-2024-32877
• https://github.com/yiisoft/yii2/commit/62d081f18c3602d09e7d075bba3a0ca5c313f0b4
• https://github.com/yiisoft/yii2/commit/8cc9aeb2f0b2ffe02fb54a817064e9da75512706
• https://github.com/yiisoft/yii2/commit/f7baab16e79f2369d4838ab5653c3c07ecf26615
• https://github.com/yiisoft/yii2
• https://github.com/yiisoft/yii2/blob/2.0.49.x/framework/CHANGELOG.md#20494-june-4-2024

CVE-2024-32877 · published 2024-06-02T22:27:54Z · modified 2026-09-10T03:50:15.691870107Z · JSON