Vulnerability · Published Jun 5, 2025 · Assigned by GitHub_M
CVE-2025-48493Yii 2 Redis may expose AUTH paramters in logs in case of connection failure
Medium 5.1
In plain English
A medium-severity sensitive data in logs in yii2-redis from yiisoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | yiisoft/yii2-redis | 2.0.20 | GHSA-g3p6-82vc-43jh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| yiisoft | yii2-redis | < 2.0.20 |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H