In CISA KEV9.0 CriticalCWE-424
CVE-2024-58136
Yiiframework Yii Improper Protection of Alternate Path Vulnerability
YiiframeworkYii
Status
- Exploited in the wild
- In CISA KEV since 2 May 2025
Federal deadlineFri 23 May 2025, 23:59 UTC
Passed 519 days ago
CISA KEV · added 2 May 2025
Exploit probabilityEPSSchecked 11 Oct
88%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.0Critical
Description NVD
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage No articles yet
No CyberSIXT article names CVE-2024-58136 yet. New articles appear here and in the RSS feed.