CVE-2020-15148
Description
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
NVD
Severity: CRITICAL
CVE ID: CVE-2020-15148
CVSS Score: 10.0
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub, Inc.
Severity: HIGH
CVE ID: CVE-2020-15148
CVSS Score: 8.9
CVSS Metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
Proof Of Concept
Nuclei Templates for CVE-2020-15148
Refrence: Project Discovery GitHub
Maskhe
几条关于CVE-2020-15148（yii2反序列化）的绕过
Refrence: GitHub
0xkami
cve-2020-15148
Refrence: GitHub