{"action":"Upgrade yiisoft/yii2 to 2.0.14 or later.","affected":[{"fixed":"2.0.14","introduced":"2.0"}],"component":"yiisoft/yii2","cve_ids":["CVE-2018-6009"],"ecosystem":"Packagist","epss":0.00597,"exploited":false,"fixed_versions":["2.0.14"],"ghsa_id":"GHSA-cwhm-272p-3wj9","id":"tcs_01M5KF192K7PH76MA2M71H4004","modified_at":"2024-04-24T18:57:22.298973Z","published_at":"2022-05-14T03:45:23Z","references":["https://osv.dev/vulnerability/GHSA-cwhm-272p-3wj9","https://nvd.nist.gov/vuln/detail/CVE-2018-6009","https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7","https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2018-6009.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2018-6009.yaml","https://github.com/yiisoft/yii2-framework","https://www.yiiframework.com/news/165/yii-2-0-14-is-released"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-cwhm-272p-3wj9","url":"https://osv.dev/vulnerability/GHSA-cwhm-272p-3wj9"}],"summary":"Yii Framework Cross-Site Request Forgery (CSRF)"}