CVE-2025-2690
Published: 24 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-2690 is a critical vulnerability found in yiisoft Yii2 up to version 2.0.39, affecting the Generate function in the file phpunit\src\Framework\MockObject\MockClass.php. The flaw stems from improper input validation (CWE-20) enabling deserialization (CWE-502), and it was published on 2025-03-24.
The vulnerability can be exploited remotely by attackers with low privileges (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation maintains unchanged scope (S:U) and yields low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), resulting in a CVSS 3.1 base score of 6.3.
Advisories and additional details are documented in references including VulDB entries at https://vuldb.com/?ctiid.300711, https://vuldb.com/?id.300711, and https://vuldb.com/?submit.521718, as well as a GitHub disclosure at https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2-2.md. The exploit has been publicly disclosed and may be used.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The critical deserialization vulnerability (CVE-2025-2690) in Yii2 web framework up to 2.0.39 allows remote attackers to achieve arbitrary code execution via crafted input to the Generate function in MockClass.php, enabling exploitation of public-facing web applications.