{"id":"CVE-2018-6009","aliases":["GHSA-cwhm-272p-3wj9"],"url":"https://o3.security/vulnerability/CVE-2018-6009","summary":"Yii Framework Cross-Site Request Forgery (CSRF)","details":"In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.","published":"2018-01-22T22:29:00.207Z","modified":"2026-08-07T11:48:26.176475183Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"yiisoft/yii2","fixedVersion":"2.0.14"},{"ecosystem":"Packagist","name":"yiisoft/yii2-dev","fixedVersion":"2.0.14"}],"fix":{"url":"https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7","label":"yiisoft/yii2@6c0540a"},"references":[{"type":"FIX","url":"https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:48:26.176475183Z"}}