CVE-2024-4990 in the critical feed json
Unsafe Reflection in base Component class in yiisoft/yii2
published 2024-06-02 2 y ago modified 2026-06-17 4 mo ago also GHSA-cjcc-p67m-7qxm , EUVD-2024-2024
- cvss
- 8.1
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 80.1%
- EPSS 80.1% chance of exploitation in 30 days, percentile 99.6%
- public exploits
- 0
- none known
Summary
In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.
Patch / fix
- packagist yiisoft/yii2 2.0.49.4
- github.com/yiisoft/yii2@628d406 commit
- github.com/yiisoft/yii2@62d081f commit
- github.com/yiisoft/yii2#20183 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
80.10% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/4fbdd965-02b6-42e4-b57b-f98f93415b8f referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | yiisoft/yii2 | <2.0.49.4 |
2.0.49.4 |
Affected products
- yiisoft yiisoft/yii2
Classification
- Weakness
-
- CWE-470 Use of Externally-Controlled Input to Select Classes or Code
References
-
github.com
/yiisoft/yii2/pull/20183
web
-
github.com
/yiisoft/yii2/commit/628d406bfafb80fc32147837888c0057d89a021e
web
-
github.com
/yiisoft/yii2/commit/62d081f18c3602d09e7d075bba3a0ca5c313f0b4
web
-
huntr.com
/bounties/4fbdd965-02b6-42e4-b57b-f98f93415b8f
exploit, web
-
github.com
/yiisoft/yii2/security/advisories/GHSA-cjcc-p67m-7qxm
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-4990
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2024-4990.yaml
web
-
github.com
/yiisoft/yii2
package
-
github.com
/yiisoft/yii2/blob/master/framework/CHANGELOG.md#2050-may-30-2024
web
Sources
- CVE List CVE-2024-4990
- GitHub Advisory GHSA-cjcc-p67m-7qxm
- NVD CVE-2024-4990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.