{"id":"CVE-2018-6009","details":"In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.","aliases":["GHSA-cwhm-272p-3wj9"],"modified":"2026-05-17T11:54:34.137600802Z","published":"2018-01-22T22:29:00.207Z","database_specific":{"unresolved_ranges":[{"vendor_product":"yiiframework:yiiframework","cpes":["cpe:2.3:a:yiiframework:yiiframework:2.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"2.0.0"}],"source":"CPE_FIELD"}]},"references":[{"type":"FIX","url":"https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7"}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}