GitHub Advisoryadvisory · Packagist

GHSA-g3p6-82vc-43jh Yii 2 Redis may expose AUTH parameters in logs in case of connection failure

MEDIUM Published 2025-06-05 Modified 2025-06-06 Official page ↗
Aliases
CVE-2025-48493
Ecosystem
Packagist
Packages
yiisoft/yii2-redis
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H
Weaknesses
CWE-532
Reviewed
2025-06-05

Affected packages

• Packagist yiisoft/yii2-redis: < 2.0.20 → fixed in 2.0.20

Description

Impact On failing connection extension writes commands sequence to logs. AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs.

Related

Alias · CVE (1)

  • CVE-2025-48493 The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References