Cross-Origin Resource Sharing Misconfiguration in Yii Framework by Yii Software

CVE-2018-20745

What is CVE-2018-20745?

The Yii Framework versions up to 2.0.15.1 demonstrate a significant security flaw where a wildcard CORS policy allows the conversion of arbitrary Origin header values. This alteration undermines the intended CORS security model, potentially allowing attackers to execute cross-origin requests that compromise sensitive data or application integrity. This vulnerability highlights the importance of precise configurations of CORS to maintain robust web application security.

References