Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

The version of Yii Framework installed on the remote host is prior to 2.0.52. It is, therefore, affected by an unsafe reflection vulnerability.

  - Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a   CVE-2024-4990 regression, as exploited in the wild in February through April 2025. (CVE-2024-58136)  

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CraftCMS version 3.x prior to 3.9.15 or 4.x prior to 4.14.15 or 5.x prior to 5.6.16 is vulnerable to a Remote Code Execution (RCE) in the action endpoint.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a
    CVE-2024-4990 regression, as exploited in the wild in February through April 2025. (CVE-2024-58136)

ID	Name	Product	Family	Type	Severity
261483	Yii Framework < 2.0.52 Unsafe Reflection Regression (GHSA-ggwg-cmwp-46r5)	Nessus	Misc.	Local	critical
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
424830	SCA: security update for yiisoft/yii2 (GHSA-ggwg-cmwp-46r5)	Tenable Cloud Security	SCA Checks	Local	critical
424830	SCA: security update for yiisoft/yii2 (GHSA-ggwg-cmwp-46r5)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2024-58136

critical

Tenable Plugins

critical

critical

critical

critical