CVE-2024-58136: Yiiframework Yii Improper Protection of Alternate Path Vulnerability
Critical · CVSS 9.0 (CVSS 3.1)KEV known exploitedEPSS 87.8%, 100th percentilePublished Updated Assigner: mitre
In CISA’s Known Exploited Vulnerabilities catalog: Yiiframework Yii Improper Protection of Alternate Path Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · CWE-424
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
yiiframework: Yii
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12 (opens in new tab)
- github.com/yiisoft/yii2/compare/2.0.51...2.0.52 (opens in new tab)
- github.com/yiisoft/yii2/pull/20232 (opens in new tab)
- github.com/yiisoft/yii2/pull/20232 (opens in new tab)
- www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)