Description
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | yiisoft/yii2 | >= 2.0, < 2.0.14 | 2.0.14 | GHSA-cwhm-272p-3wj9 |
| Packagist | yiisoft/yii2-dev | >= 2.0, < 2.0.14 | 2.0.14 | GHSA-cwhm-272p-3wj9 |