CVE-2025-48493: Yii 2 Redis may expose AUTH parameters in logs in case of connection failure
Impact
On failing connection extension writes commands sequence to logs. AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs.
Other sources
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
— NVD
Yii 2 Redis may expose AUTH parameters in logs in case of connection failure
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/yiisoft/yii2-redisto a version that resolves this vulnerability.Fixed in 2.0.20 - Upgrade
Upgrade
Yii 2 Redisto a version that resolves this vulnerability.Fixed in 2.0.20
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48493?
CVE-2025-48493 is considered a medium severity vulnerability due to the exposure of sensitive credentials in log files.
How do I fix CVE-2025-48493?
To fix CVE-2025-48493, update the Yii 2 Redis extension to version 2.0.20 or later.
What are the risks associated with CVE-2025-48493?
The risks include potential exposure of usernames and passwords in logs, which could be exploited by unauthorized users with access to those logs.
Which version of the Yii 2 Redis extension is affected by CVE-2025-48493?
Versions prior to 2.0.20 of the Yii 2 Redis extension are affected by CVE-2025-48493.
Is this vulnerability related to any specific software?
Yes, CVE-2025-48493 specifically affects the Yii 2 Redis extension used with the Yii framework.