CVE-2018-20745: Origin Validation Error

May 14, 2022 (updated August 28, 2023)

Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

References

github.com/advisories/GHSA-cr6r-6xm9-ww22
github.com/yiisoft/yii2/issues/16193
github.com/yiisoft/yii2/pull/16198
nvd.nist.gov/vuln/detail/CVE-2018-20745
www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf

Detect and mitigate CVE-2018-20745 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →