« Volver al listado

CVE-2014-4672

Estado: ModificadaAlta (7.5)—

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yiiframework — Yiiframework

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-4672",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-03T17:55:06.377",
  "references": [
    {
      "url": "http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property."
    },
    {
      "lang": "es",
      "value": "El widget CDetailView en Framework PHP de Yii  versión 1.1.14, permite a los atacantes remotos ejecutar scripts PHP arbitrarios por medio de vectores relacionados con la propiedad value."
    }
  ],
  "lastModified": "2026-06-17T00:10:26.507",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yiiframework:yiiframework:1.1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9481F4EE-74D4-4B5C-95DB-BB330F77A4BB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "per http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/:\n\n\"Note that the issue only affects 1.1.14. All previous releases are not affected\"",
  "sourceIdentifier": "cve@mitre.org"
}