CVE-2025-48493
BaseFortify
Publication date: 2025-06-05
Last updated on: 2025-09-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yiiframework | yii2-redis | to 2.0.20 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Yii 2 Redis extension occurs when a connection to Redis fails. The extension logs the sequence of commands, including sensitive AUTH parameters such as usernames and passwords, in plaintext. This means if an attacker has access to these logs, they can see these credentials. The issue was fixed in version 2.0.20 by sanitizing the logs to mask AUTH parameters, preventing sensitive information from being exposed. [1, 2]
How can this vulnerability impact me? :
If an attacker with high privileges gains access to the logs, they can obtain sensitive authentication credentials (usernames and passwords) that were logged in plaintext. This can lead to credential leakage and potential unauthorized access. The impact on confidentiality, integrity, and availability is rated as low to moderate, but availability of downstream systems could be significantly affected. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking your logs for any Redis AUTH commands that include plaintext usernames and passwords. Specifically, search your application or system logs for entries containing 'AUTH' followed by credentials. For example, you can use commands like `grep 'AUTH' /path/to/your/logfile` on Linux systems to find such entries. If you find AUTH parameters in plaintext in logs, your system is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade the yii2-redis extension to version 2.0.20 or later, where the issue is fixed by sanitizing AUTH parameters in logs. Additionally, ensure that the YII_DEBUG flag is set to false in production environments to prevent sensitive information from being logged. Review and restrict access to logs to prevent attackers from obtaining credentials if they gain access. [1, 2]