CVE-2021-3689

Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

8.1 HighFix available

CVE-2021-3689 is a high vulnerability (CVSS 8.1) in Yiiframework Yii, published August 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in yiisoft/yii2-dev 2.0.43.

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.90%Up 1.3 points since Aug 11, 2021

What each source reports

CVE List Score used 8.1

Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Record: CVE-2021-3689
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1241
Updated: 2026-11-02

EUVDEUVD-2021-2074 8.1

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Record: EUVD-2021-2074
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hq3v-rg6f-6hx4 7.5

Use of Insufficiently Random Values in yiisoft/yii2-dev

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Record: GHSA-hq3v-rg6f-6hx4
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-330
Updated: 2026-11-02

NVD 7.5

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Record: CVE-2021-3689
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-1241, CWE-330
Updated: 2026-11-02

OSV 7.5

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Record: CVE-2021-3689
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-hq3v-rg6f-6hx4 7.5

Use of Insufficiently Random Values in yiisoft/yii2-dev

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Record: GHSA-hq3v-rg6f-6hx4
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-330
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`yiisoft/yii2-dev` Packagist	before 2.0.43	2.0.43
`yiisoft/yii2-dev` Packagist	before 2.0.43, plus listed versions 2.0.02.0.0-alpha2.0.0-beta2.0.0-rc2.0.1 Show 45 moreShow less 2.0.102.0.112.0.11.12.0.11.22.0.122.0.12.12.0.12.22.0.132.0.13.12.0.13.22.0.13.32.0.142.0.14.12.0.14.22.0.152.0.15.12.0.162.0.16.12.0.172.0.182.0.192.0.22.0.202.0.212.0.222.0.232.0.242.0.252.0.262.0.272.0.282.0.292.0.32.0.302.0.312.0.322.0.332.0.342.0.352.0.362.0.372.0.382.0.392.0.39.12.0.39.2	2.0.43

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 12 versions. The JSON record has them.