CVE-2024-58136

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 87,8%

Kerentanan Improper Protection of Alternate Path pada yiiframework yii. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 2 Mei 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

Rincian

Terbit di NVD

10 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-424: Improper Protection of Alternate Path

EPSS (30 hari)

87,8% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Masuk KEV

2 Mei 2025

Tenggat CISA

23 Mei 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52 advisory vendor
• https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12 patch
• https://github.com/yiisoft/yii2/pull/20232 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136 pemerintah AS
• https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ exploit · advisory pihak ketiga
• https://github.com/yiisoft/yii2/compare/2.0.51...2.0.52 issue tracking
• https://github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709 issue tracking