Unsafe Reflection in base Component class in yiisoft/yii2
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Yiiframework | yiisoft/yii2 | up to latest | — | No fix listed | CNA |
| — | yiisoft/yii2 (Packagist) | before 2.0.49.4 | 2.0.49.4 | Patch available | GHSA-cjcc-p67m-7qxm |
- yiisoft/yii2 VendorYiiframework Affected up to latest Fixed in — No fix listed CNA
- yiisoft/yii2 (Packagist) Vendor— Affected before 2.0.49.4 Fixed in 2.0.49.4 Patch available GHSA-cjcc-p67m-7qxm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yiiframework:yii:2.0.48:*:*:*:*:*:*:* | 2.0.48 | Vulnerable | Yiiframework |
- cpe:2.3:a:yiiframework:yii:2.0.48:*:*:*:*:*:*:* Versions 2.0.48 Vulnerable ·Yiiframework
Remediation
- Fix · GHSA-cjcc-p67m-7qxm yiisoft/yii2 (Packagist) Fixed in 2.0.49.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4990
- 2026-10-03 Alias added: GHSA-cjcc-p67m-7qxm
References
Other 7
- https://github.com/yiisoft/yii2/security/advisories/GHSA-cjcc-p67m-7qxm
- https://github.com/yiisoft/yii2/pull/20183
- https://github.com/yiisoft/yii2/commit/628d406bfafb80fc32147837888c0057d89a021e
- https://github.com/yiisoft/yii2/commit/62d081f18c3602d09e7d075bba3a0ca5c313f0b4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2024-4990.yaml
- https://github.com/yiisoft/yii2
- https://github.com/yiisoft/yii2/blob/master/framework/CHANGELOG.md#2050-may-30-2024
More Yiiframework Yii vulnerabilities
- TI-2024-38344 Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-11920 Unsafe deserialization in Yii 2 CVSS 3.1CRITICAL 10.0
- TI-2025-02355 yiisoft Yii2 MockClass.php generate deserialization CVSS 4.0MEDIUM 5.3
- TI-2025-02354 yiisoft Yii2 SortableIterator.php getIterator deserialization CVSS 4.0MEDIUM 5.3
- TI-2023-11755 SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows… CVSS 3.1CRITICAL 9.8
- TI-2015-04601 web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-4990 · CVE Program
- CVE-2024-4990 · NVD
- FIRST EPSS
- GHSA-cjcc-p67m-7qxm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences