Cyber Posture

CVE-2025-2690

MediumPublic PoC

Published: 24 March 2025

Published
24 March 2025
Modified
24 March 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0008 23.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-2690 is a critical vulnerability found in yiisoft Yii2 up to version 2.0.39, affecting the Generate function in the file phpunit\src\Framework\MockObject\MockClass.php. The flaw stems from improper input validation (CWE-20) enabling deserialization (CWE-502), and it was published on 2025-03-24.

The vulnerability can be exploited remotely by attackers with low privileges (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation maintains unchanged scope (S:U) and yields low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), resulting in a CVSS 3.1 base score of 6.3.

Advisories and additional details are documented in references including VulDB entries at https://vuldb.com/?ctiid.300711, https://vuldb.com/?id.300711, and https://vuldb.com/?submit.521718, as well as a GitHub disclosure at https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2-2.md. The exploit has been publicly disclosed and may be used.

Details

CWE(s)
CWE-20CWE-502

Affected Products

yiiframework
yii
2.0.0 — 2.0.39

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The critical deserialization vulnerability (CVE-2025-2690) in Yii2 web framework up to 2.0.39 allows remote attackers to achieve arbitrary code execution via crafted input to the Generate function in MockClass.php, enabling exploitation of public-facing web applications.

References