Description
Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | yiisoft/yii2-dev | >= 2.0.0, < 2.0.15 | 2.0.15 | GHSA-m2p5-fwp2-qcw2 |
| Packagist | yiisoft/yii2-elasticsearch | < 2.0.5 | 2.0.5 | GHSA-m2p5-fwp2-qcw2 |