PT-2025-23939 · Yii · Yii 2 Redis Extension

Samdark · Publicado 2025-06-05 · Atualizado 2025-06-05 · CVE-2025-48493

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yii 2 Redis extension versions prior to 2.0.20

Description The issue concerns the logging of commands when a connection fails in the Yii 2 Redis extension. Specifically, prior to version 2.0.20, AUTH parameters are written in plain text, exposing the username and password. This could be problematic if an attacker gains access to the logs.

Recommendations For versions prior to 2.0.20, update to version 2.0.20 to resolve the issue. As a temporary workaround, consider restricting access to the logs to minimize the risk of exploitation.

Exploit

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

BDU:2025-09066

CVE-2025-48493

GHSA-G3P6-82VC-43JH

Produtos afetados

Yii 2 Redis Extension

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48493.json · Exploit
• https://github.com/yiisoft/yii2-redis/security/advisories/GHSA-g3p6-82vc-43jh · Aviso do Fabricante
• https://github.com/yiisoft/yii2-redis/commit/962252d2c57c187181e67bb66da3f27b4698358d · Correção
• https://github.com/yiisoft/yii2-redis · Nota
• https://bdu.fstec.ru/vul/2025-09066 · Nota de Segurança
• https://twitter.com/CVEnew/status/1930668015772647828 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-48493 · Aviso do Fabricante
• https://t.me/cvetracker/25525 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-48493 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1930689664958021645 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-g3p6-82vc-43jh · Aviso do Fabricante