Plain Text Exposure in Yii 2 Redis Extension Affects Key-Value Store Security
CVE-2025-48493

5.1MEDIUM

Key Information:

Vendor

Yiisoft

Status
Yii2-redis
Vendor
CVE Published:
5 June 2025

What is CVE-2025-48493?

The Yii 2 Redis extension, essential for integrating Redis key-value store functionality within the Yii framework 2.0, contains a vulnerability where, upon connection failure, sensitive AUTH parameters such as usernames and passwords are logged in plaintext. This exposure could pose a significant security risk if an unauthorized user gains access to these logs. It is crucial for users of versions prior to 2.0.20 to upgrade to this version, which addresses the issue by preventing sensitive data from being logged.

Affected Version(s)

yii2-redis < 2.0.20

References

https://github.com/yiisoft/yii2-redis/security/advisories...
x_refsource_CONFIRM
https://github.com/yiisoft/yii2-redis/commit/962252d2c57c...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48493 : Plain Text Exposure in Yii 2 Redis Extension Affects Key-Value Store Security