CVE-2025-48493: Yii 2 Redis may expose AUTH paramters in logs in case of connection failure
Impact
On failing connection extension writes commands sequence to logs. AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs.
Other sources
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48493?
CVE-2025-48493 is considered a medium severity vulnerability due to the exposure of sensitive credentials in log files.
How do I fix CVE-2025-48493?
To fix CVE-2025-48493, update the Yii 2 Redis extension to version 2.0.20 or later.
What are the risks associated with CVE-2025-48493?
The risks include potential exposure of usernames and passwords in logs, which could be exploited by unauthorized users with access to those logs.
Which version of the Yii 2 Redis extension is affected by CVE-2025-48493?
Versions prior to 2.0.20 of the Yii 2 Redis extension are affected by CVE-2025-48493.
Is this vulnerability related to any specific software?
Yes, CVE-2025-48493 specifically affects the Yii 2 Redis extension used with the Yii framework.