CVE-2024-58136
Yiiframework Yii ≤ 2.0.52
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2024-58136 is a critical-severity Improper Protection of Alternate Path (CWE-424) vulnerability in Yiiframework Yii. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Yii 2 before version 2.0.52 contains a vulnerability that mishandles attachment of behaviors specified via an __class array key. The flaw is a regression of CVE-2024-4990 and affects the Yii framework's behavior attachment logic, allowing improper class resolution during object configuration.
An unauthenticated remote attacker can supply a crafted configuration array over the network to trigger the issue. Successful exploitation yields full control over the affected application, including arbitrary code execution and impacts to confidentiality, integrity, and availability, as reflected in the CVSS 9.0 score with changed scope.
Official references direct users to upgrade to Yii 2.0.52. The fix is documented in the project's GitHub commit 40fe496eda529fd1d933b56a1022ec32d3cd0b12, the 2.0.51-to-2.0.52 diff, pull request 20232, and the Yii Framework security advisory that explicitly recommends immediate patching.
The CVE was exploited in the wild between February and April 2025, coinciding with EPSS values that reached a peak of 0.7895 and remain at 0.7726.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10502
Vulnerability Data
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
- CWE(s)
- KEV Date Added
- 02 May 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Requiring access-control decisions to be applied to each request ensures no alternate path can bypass authorization checks.
A reference monitor that is always invoked by definition covers every possible path, eliminating the root cause of unprotected alternate paths.
Enforcing approved authorizations for every logical access request structurally blocks unprotected alternate paths to restricted resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Privileged access rights must be enforced on every possible route to privileged functions.
Security testing can discover unprotected alternate paths before release.
Information access restriction mechanisms must close all alternate paths to restricted data or functions.
Access control policy directly requires protection of all entry points to restricted functionality.
Managing access rights must cover every alternate path that could bypass intended restrictions.
Network security can limit some alternate paths but is not the primary control for application-level path protection.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-424
RHEL 9 (1 rule)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-424
Ubuntu 22.04 (1 rule)
- V-260529 Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. prevents CWE-424
Ubuntu 24.04 (1 rule)
- V-270708 Ubuntu 24.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. prevents CWE-424