CVE-2018-6010
Yii Framework reflected Cross-site Scripting
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Record
CVE-2018-6010- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Record
CVE-2018-6010- Updated
- 2026-11-02
EUVDEUVD-2022-3177 No score
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Record
EUVD-2022-3177- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8gfq-c54m-3rf6
Yii Framework reflected Cross-site Scripting
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Record
GHSA-8gfq-c54m-3rf6- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Record
CVE-2018-6010- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-8gfq-c54m-3rf6
Yii Framework reflected Cross-site Scripting
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Record
GHSA-8gfq-c54m-3rf6- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yiisoft/yii2Packagist |
2.0.0 up to 2.0.14 | 2.0.14 |
yiisoft/yii2Packagist |
2.0.0 up to 2.0.14, plus listed versions 2.0.12.0.102.0.112.0.11.12.0.11.2 Show 15 moreShow less2.0.122.0.12.12.0.12.22.0.132.0.13.12.0.13.22.0.13.32.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.9 |
2.0.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-6010 is a high vulnerability (CVSS 7.5) in Yiiframework, published January 22, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in yiisoft/yii2 2.0.14.
References
github.com/yiisoft/yii2/pull/15534
nvd.nist.gov/vuln/detail/CVE-2018-6010
yiiframework.com/news/165/yii-2-0-14-is-released