CVE-2023-47130

Name of the Vulnerable Software and Affected Versions yiisoft/yii versions prior to 1.1.29

Description The issue allows for Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input. An attacker may leverage this to compromise the host system.

Recommendations For versions prior to 1.1.29, upgrade to version 1.1.29 or higher. As a temporary workaround, consider avoiding the use of unserialize() on arbitrary user input until the issue is resolved. Restrict access to sensitive areas of the application to minimize the risk of exploitation.