CVE DatabaseCVE-2024-4990

Updated 2026-06-17한국어 권고문 →

CVE-2024-49909.1/CRITICALCWE-470

CVE-2024-4990 Official NVD Security Advisory (CVSS 9.1)

⚡ Jump to Patch

Affected Vendors

security-advisory

Affected Components

software

Published Date

2025-03-20

CVSS v3.1

9.1

CRITICAL

EPSS (30d)

80.1%

FIRST.org

CISA KEV

Not Listed

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Scope

Impacted configurations listed under CVE-2024-4990

Overview

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the __set() magic method does not validate that th...

Mitigation

Review official patches and verify network isolation controls.

Affected Products & Version Scope

Refer to official NVD CPE configuration entries

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Apply the latest security updates provided by the official software maintainers.

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Audit runtime exposure and verify patching status via automated scanning.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

Official NVD Technical Description

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the __set() magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.

CVSS Score: 9.1 (CRITICAL)
CWE IDs: CWE-470

Official Vendor Advisories & References

NVD Original English Description

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.

https://huntr.com/bounties/4fbdd965-02b6-42e4-b57b-f98f93415b8f

Source: security@huntr.dev · Exploit

https://huntr.com/bounties/4fbdd965-02b6-42e4-b57b-f98f93415b8f

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Exploit

Frequently Asked SecOps Questions (CVE-2024-4990)

FAQ

Q1. How critical is CVE-2024-4990 and is it actively exploited in the wild?

CVE-2024-4990 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 80.1%. Organizations running affected versions should prioritize patching based on network exposure.

Q2. Which vendors and products are affected by CVE-2024-4990?

Primary impacted vendors include security-advisory across software. Scope summary: Refer to official NVD CPE configuration entries

Q3. What temporary mitigations or workarounds exist for CVE-2024-4990 before patching?

[Mitigation] Review official patches and verify network isolation controls. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION