{"id":"CVE-2020-15148","published":"2020-09-15T18:25:12Z","modified":"2024-08-04T13:08:21Z","title":"Unsafe deserialization in Yii 2","vendor":"yiisoft","product":"yii2","tier":"core","eol":null,"affectedVersions":[{"vendor":"yiisoft","product":"yii2","versions":["< 2.0.38"]}],"description":{"text":"Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.","provenance":"source","from":"CVE.org"},"summary":{"text":"Unsafe deserialization in the Yii 2 PHP framework (yiisoft/yii2, the yii2 product from yiisoft) affects versions before 2.0.38 and lives in the application's handling of serialized data. An attacker who can supply arbitrary input that the application passes to unserialize() can achieve remote code execution, though the attack is conditional on the application actually calling unserialize() on that untrusted input and on the attacker reaching it over the network without authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:52Z"},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.77538,"percentile":0.99559,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"yiisoft/yii2","vulnerableRanges":["<2.0.38"],"patched":["2.0.38"],"from":["GHSA-699q-wcff-g9mj"],"provenance":"source"}],"advisories":[{"id":"GHSA-699q-wcff-g9mj","url":"https://github.com/advisories/GHSA-699q-wcff-g9mj","severity":"HIGH","ecosystem":"Packagist","package":"yiisoft/yii2","vulnerableRanges":["<2.0.38"],"patched":["2.0.38"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0813","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0813","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2020-09-21","earliestUrl":"https://github.com/Maskhe/CVE-2020-15148-bypasses","repos":[{"name":"Maskhe/CVE-2020-15148-bypasses","url":"https://github.com/Maskhe/CVE-2020-15148-bypasses","stars":75,"created":"2020-09-21"},{"name":"0xkami/cve-2020-15148","url":"https://github.com/0xkami/cve-2020-15148","stars":6,"created":"2020-10-27"}]},"nuclei":[{"id":"CVE-2020-15148","name":"Yii 2 < 2.0.38 - Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-15148.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15148.yaml"}],"first":{"date":"2020-09-21","source":"PoC-in-GitHub","url":"https://github.com/Maskhe/CVE-2020-15148-bypasses"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-09-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-15148","provenance":"source"},{"date":"2020-09-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Maskhe/CVE-2020-15148-bypasses","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9956"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.23,"detail":"base score 8.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-6009","published":"2018-01-22","fixed":"2.0.14","kev":false},{"cve":"CVE-2018-6010","published":"2018-01-22","fixed":"2.0.14","kev":false},{"cve":"CVE-2018-20745","published":"2019-01-28","fixed":"2.0.16","kev":false,"link":{"from":"CVE-2018-20745","to":"CVE-2020-15148","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:yiisoft/yii2","fromFixed":"2.0.16","toFixed":"2.0.38","daysApart":596}]}},{"cve":"CVE-2020-15148","published":"2020-09-15","fixed":"2.0.38","kev":false},{"cve":"CVE-2024-32877","published":"2024-05-30","fixed":"2.0.49.4","kev":false},{"cve":"CVE-2024-4990","published":"2025-03-20","fixed":"2.0.49.4","kev":false},{"cve":"CVE-2024-58136","published":"2025-04-10","fixed":"2.0.52","kev":true}],"package":"Packagist:yiisoft/yii2"}}