CVE-2023-47130

Summary

CVE-2023-47130 is a remote code execution (RCE) vulnerability affecting versions of the open-source PHP web framework Yii, specifically those below 1.1.29. The issue arises when the application uses the `unserialize()` function on untrusted user input, allowing an attacker to execute arbitrary code. This vulnerability could potentially lead to a compromise of the host system. A patch has been released for version 1.1.29, and users are strongly advised to upgrade as soon as possible. No known workarounds exist for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.