Description

The Yii2 Gii extension was found in the web application. Gii is a Web-based code generator for Yii2, which should be enabled only for the development environment with a strict white-list of allowed IP addresses

Remediation

Disable the Gii extension or restrict access to proper IP addresses only

References

Yii2 Framework: Security best practices

Related Vulnerabilities

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4593)

Sensitive Data Exposure

WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.3)

[Possible] Password Transmitted over Query String

Web Application Firewall Detected

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Configuration