{"id":"CVE-2018-20745","published":"2019-01-28T08:00:00Z","modified":"2024-09-17T00:56:20Z","title":"Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value…","vendor":null,"product":null,"tier":"tail","description":{"text":"Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00544,"percentile":0.45567,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf","tags":["x_refsource_MISC"]},{"url":"https://github.com/yiisoft/yii2/issues/16193","tags":["x_refsource_MISC"]}],"priority":{"score":9.1,"factors":[{"name":"EPSS percentile","points":9.11}]},"affected":[{"ecosystem":"Packagist","package":"yiisoft/yii2","vulnerableRanges":["<2.0.16"],"patched":["2.0.16"],"from":["GHSA-cr6r-6xm9-ww22"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3621","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-11516","published":"2017-07-21","fixed":"2.0.13","kev":false},{"cve":"CVE-2018-6009","published":"2018-01-22","fixed":"2.0.14","kev":false,"link":{"from":"CVE-2018-6009","to":"CVE-2018-20745","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:yiisoft/yii2","fromFixed":"2.0.14","toFixed":"2.0.16","daysApart":371}]}},{"cve":"CVE-2018-6010","published":"2018-01-22","fixed":"2.0.14","kev":false},{"cve":"CVE-2018-20745","published":"2019-01-28","fixed":"2.0.16","kev":false},{"cve":"CVE-2020-15148","published":"2020-09-15","fixed":"2.0.38","kev":false,"link":{"from":"CVE-2018-20745","to":"CVE-2020-15148","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:yiisoft/yii2","fromFixed":"2.0.16","toFixed":"2.0.38","daysApart":596}]}},{"cve":"CVE-2024-32877","published":"2024-05-30","fixed":"2.0.49.4","kev":false},{"cve":"CVE-2024-4990","published":"2025-03-20","fixed":"2.0.49.4","kev":false}],"package":"Packagist:yiisoft/yii2"}}