{"id":"CVE-2018-6009","published":"2018-01-22T22:00:00Z","modified":"2024-08-05T05:47:56Z","title":"In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00597,"percentile":0.48423,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7","tags":["x_refsource_CONFIRM"]}],"priority":{"score":9.7,"factors":[{"name":"EPSS percentile","points":9.68}]},"affected":[{"ecosystem":"Packagist","package":"yiisoft/yii2","vulnerableRanges":[">=2.0, <2.0.14"],"patched":["2.0.14"],"from":["GHSA-cwhm-272p-3wj9"],"provenance":"source"},{"ecosystem":"Packagist","package":"yiisoft/yii2-dev","vulnerableRanges":[">=2.0, <2.0.14"],"patched":["2.0.14"],"from":["GHSA-cwhm-272p-3wj9"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3649","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2015-5467","published":"2023-09-21","fixed":"2.0.5","kev":false},{"cve":"CVE-2017-7271","published":"2017-03-27","fixed":"2.0.11","kev":false},{"cve":"CVE-2017-11516","published":"2017-07-21","fixed":"2.0.13","kev":false,"link":{"from":"CVE-2017-11516","to":"CVE-2018-6009","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:yiisoft/yii2","fromFixed":"2.0.13","toFixed":"2.0.14","daysApart":185}]}},{"cve":"CVE-2018-6009","published":"2018-01-22","fixed":"2.0.14","kev":false},{"cve":"CVE-2018-6010","published":"2018-01-22","fixed":"2.0.14","kev":false},{"cve":"CVE-2018-20745","published":"2019-01-28","fixed":"2.0.16","kev":false,"link":{"from":"CVE-2018-6009","to":"CVE-2018-20745","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:yiisoft/yii2","fromFixed":"2.0.14","toFixed":"2.0.16","daysApart":371}]}},{"cve":"CVE-2020-15148","published":"2020-09-15","fixed":"2.0.38","kev":false}],"package":"Packagist:yiisoft/yii2"}}