CVE-2025-2690 (GCVE-0-2025-2690)
Vulnerability from cvelistv5 – Published: 2025-03-24 07:31 – Updated: 2025-03-24 12:14
VLAI?
Title
yiisoft Yii2 MockClass.php generate deserialization
Summary
A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity ?
6.3 (Medium)
6.3 (Medium)
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| yiisoft | Yii2 |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 Affected: 2.0.12 Affected: 2.0.13 Affected: 2.0.14 Affected: 2.0.15 Affected: 2.0.16 Affected: 2.0.17 Affected: 2.0.18 Affected: 2.0.19 Affected: 2.0.20 Affected: 2.0.21 Affected: 2.0.22 Affected: 2.0.23 Affected: 2.0.24 Affected: 2.0.25 Affected: 2.0.26 Affected: 2.0.27 Affected: 2.0.28 Affected: 2.0.29 Affected: 2.0.30 Affected: 2.0.31 Affected: 2.0.32 Affected: 2.0.33 Affected: 2.0.34 Affected: 2.0.35 Affected: 2.0.36 Affected: 2.0.37 Affected: 2.0.38 Affected: 2.0.39 |
Credits
gaorenyusi (VulDB User)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2690",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-24T12:12:44.235025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T12:14:34.960Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Yii2",
"vendor": "yiisoft",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
},
{
"status": "affected",
"version": "2.0.12"
},
{
"status": "affected",
"version": "2.0.13"
},
{
"status": "affected",
"version": "2.0.14"
},
{
"status": "affected",
"version": "2.0.15"
},
{
"status": "affected",
"version": "2.0.16"
},
{
"status": "affected",
"version": "2.0.17"
},
{
"status": "affected",
"version": "2.0.18"
},
{
"status": "affected",
"version": "2.0.19"
},
{
"status": "affected",
"version": "2.0.20"
},
{
"status": "affected",
"version": "2.0.21"
},
{
"status": "affected",
"version": "2.0.22"
},
{
"status": "affected",
"version": "2.0.23"
},
{
"status": "affected",
"version": "2.0.24"
},
{
"status": "affected",
"version": "2.0.25"
},
{
"status": "affected",
"version": "2.0.26"
},
{
"status": "affected",
"version": "2.0.27"
},
{
"status": "affected",
"version": "2.0.28"
},
{
"status": "affected",
"version": "2.0.29"
},
{
"status": "affected",
"version": "2.0.30"
},
{
"status": "affected",
"version": "2.0.31"
},
{
"status": "affected",
"version": "2.0.32"
},
{
"status": "affected",
"version": "2.0.33"
},
{
"status": "affected",
"version": "2.0.34"
},
{
"status": "affected",
"version": "2.0.35"
},
{
"status": "affected",
"version": "2.0.36"
},
{
"status": "affected",
"version": "2.0.37"
},
{
"status": "affected",
"version": "2.0.38"
},
{
"status": "affected",
"version": "2.0.39"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gaorenyusi (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\\src\\Framework\\MockObject\\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Es wurde eine kritische Schwachstelle in yiisoft Yii2 bis 2.0.39 gefunden. Hiervon betroffen ist die Funktion Generate der Datei phpunit\\src\\Framework\\MockObject\\MockClass.php. Durch Manipulation mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T07:31:04.253Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-300711 | yiisoft Yii2 MockClass.php generate deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.300711"
},
{
"name": "VDB-300711 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.300711"
},
{
"name": "Submit #521718 | Yii Software LLC Yii 2.0 \u003c=2.0.39 Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.521718"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2-2.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-03-23T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-03-23T10:41:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "yiisoft Yii2 MockClass.php generate deserialization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-2690",
"datePublished": "2025-03-24T07:31:04.253Z",
"dateReserved": "2025-03-23T09:36:29.048Z",
"dateUpdated": "2025-03-24T12:14:34.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-2690\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-24T12:12:44.235025Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-24T12:14:29.795Z\"}}], \"cna\": {\"title\": \"yiisoft Yii2 MockClass.php generate deserialization\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"gaorenyusi (VulDB User)\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 6.5, \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\"}}], \"affected\": [{\"vendor\": \"yiisoft\", \"product\": \"Yii2\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0\"}, {\"status\": \"affected\", \"version\": \"2.0.1\"}, {\"status\": \"affected\", \"version\": \"2.0.2\"}, {\"status\": \"affected\", \"version\": \"2.0.3\"}, {\"status\": \"affected\", \"version\": \"2.0.4\"}, {\"status\": \"affected\", \"version\": \"2.0.5\"}, {\"status\": \"affected\", \"version\": \"2.0.6\"}, {\"status\": \"affected\", \"version\": \"2.0.7\"}, {\"status\": \"affected\", \"version\": \"2.0.8\"}, {\"status\": \"affected\", \"version\": \"2.0.9\"}, {\"status\": \"affected\", \"version\": \"2.0.10\"}, {\"status\": \"affected\", \"version\": \"2.0.11\"}, {\"status\": \"affected\", \"version\": \"2.0.12\"}, {\"status\": \"affected\", \"version\": \"2.0.13\"}, {\"status\": \"affected\", \"version\": \"2.0.14\"}, {\"status\": \"affected\", \"version\": \"2.0.15\"}, {\"status\": \"affected\", \"version\": \"2.0.16\"}, {\"status\": \"affected\", \"version\": \"2.0.17\"}, {\"status\": \"affected\", \"version\": \"2.0.18\"}, {\"status\": \"affected\", \"version\": \"2.0.19\"}, {\"status\": \"affected\", \"version\": \"2.0.20\"}, {\"status\": \"affected\", \"version\": \"2.0.21\"}, {\"status\": \"affected\", \"version\": \"2.0.22\"}, {\"status\": \"affected\", \"version\": \"2.0.23\"}, {\"status\": \"affected\", \"version\": \"2.0.24\"}, {\"status\": \"affected\", \"version\": \"2.0.25\"}, {\"status\": \"affected\", \"version\": \"2.0.26\"}, {\"status\": \"affected\", \"version\": \"2.0.27\"}, {\"status\": \"affected\", \"version\": \"2.0.28\"}, {\"status\": \"affected\", \"version\": \"2.0.29\"}, {\"status\": \"affected\", \"version\": \"2.0.30\"}, {\"status\": \"affected\", \"version\": \"2.0.31\"}, {\"status\": \"affected\", \"version\": \"2.0.32\"}, {\"status\": \"affected\", \"version\": \"2.0.33\"}, {\"status\": \"affected\", \"version\": \"2.0.34\"}, {\"status\": \"affected\", \"version\": \"2.0.35\"}, {\"status\": \"affected\", \"version\": \"2.0.36\"}, {\"status\": \"affected\", \"version\": \"2.0.37\"}, {\"status\": \"affected\", \"version\": \"2.0.38\"}, {\"status\": \"affected\", \"version\": \"2.0.39\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-03-23T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2025-03-23T01:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2025-03-23T10:41:34.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.300711\", \"name\": \"VDB-300711 | yiisoft Yii2 MockClass.php generate deserialization\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/?ctiid.300711\", \"name\": \"VDB-300711 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/?submit.521718\", \"name\": \"Submit #521718 | Yii Software LLC Yii 2.0 \u003c=2.0.39 Deserialization\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2-2.md\", \"tags\": [\"exploit\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\\\\src\\\\Framework\\\\MockObject\\\\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.\"}, {\"lang\": \"de\", \"value\": \"Es wurde eine kritische Schwachstelle in yiisoft Yii2 bis 2.0.39 gefunden. Hiervon betroffen ist die Funktion Generate der Datei phpunit\\\\src\\\\Framework\\\\MockObject\\\\MockClass.php. Durch Manipulation mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann \\u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \\u00f6ffentlichen Verf\\u00fcgung.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"Deserialization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2025-03-24T07:31:04.253Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-2690\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-24T12:14:34.960Z\", \"dateReserved\": \"2025-03-23T09:36:29.048Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2025-03-24T07:31:04.253Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…