PT-2025-23939 · Yii · Yii 2 Redis Extension

Samdark · Published 2025-06-05 · Updated 2025-06-05 · CVE-2025-48493

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yii 2 Redis extension versions prior to 2.0.20

Description The issue concerns the logging of commands when a connection fails in the Yii 2 Redis extension. Specifically, prior to version 2.0.20, AUTH parameters are written in plain text, exposing the username and password. This could be problematic if an attacker gains access to the logs.

Recommendations For versions prior to 2.0.20, update to version 2.0.20 to resolve the issue. As a temporary workaround, consider restricting access to the logs to minimize the risk of exploitation.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2025-09066

CVE-2025-48493

GHSA-G3P6-82VC-43JH

Affected Products

Yii 2 Redis Extension

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48493.json · Exploit
• https://github.com/yiisoft/yii2-redis/security/advisories/GHSA-g3p6-82vc-43jh · Vendor Advisory
• https://github.com/yiisoft/yii2-redis/commit/962252d2c57c187181e67bb66da3f27b4698358d · Patch
• https://bdu.fstec.ru/vul/2025-09066 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48493 · Security Note
• https://osv.dev/vulnerability/GHSA-g3p6-82vc-43jh · Vendor Advisory
• https://github.com/yiisoft/yii2-redis · Note
• https://twitter.com/CVEnew/status/1930668015772647828 · Twitter Post
• https://t.me/cvetracker/25525 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930689664958021645 · Twitter Post