yiisoft · yii2
Unsafe deserialization in the Yii 2 PHP framework (yiisoft/yii2, the yii2 product from yiisoft) affects versions before 2.0.38 and lives in the application's handling of serialized data. An attacker who can supply arbitrary input that the application passes to unserialize() can achieve remote code execution, though the attack is conditional on the application actually calling unserialize() on that untrusted input and on the attacker reaching it over the network without authentication or user interaction.
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Public exploit code (PoC-in-GitHub) appeared 6 days after disclosure. No confirmed exploitation is recorded.
7 fixes in yiisoft/yii2 over 7 years. The latest fix listed for yiisoft/yii2 is 2.0.52.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: yiisoft/yii2.
Upgrade to 2.0.52 or later
Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2024-4990, CVE-2024-58136).
Set the version to 2.0.52 or later in your composer.json.
First fixed in 2.0.38 for CVE-2020-15148.
| If you run | Upgrade to |
|---|---|
| All versions before 2.0.38 | 2.0.52first fix for this CVE: 2.0.38 |
“Up to” means the second version is the fix and is not affected.