CVE-2024-8927

CWE-122013 documents8 sources
Severity
7.5HIGH
EPSS
0.4%
top 36.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PHP Group PHPPHP PHP
Timeline
PublishedOct 8
Latest updateFeb 26

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

▶NVDphp/php8.1.0 — 8.1.30+2
▶CVEListV5php_group/php8.1.* — 8.1.30+2
▶Debianphp7.4< 7.4.33-1+deb11u6
▶Debianphp8.2< 8.2.24-1~deb12u1
▶Ubuntuphp7.4< 7.4.3-4ubuntu2.24

🔴Vulnerability Details

5
OSV
php5 vulnerabilities↗2025-02-26
▶
OSV
php7.0, php7.2 vulnerabilities↗2024-11-14
▶
CVEList
cgi.force_redirect configuration is bypassable due to the environment variable collision↗2024-10-08
▶
OSV
CVE-2024-8927: In PHP versions 8↗2024-10-08
▶
OSV
php7.4, php8.1, php8.3 vulnerabilities↗2024-10-01
▶

📋Vendor Advisories

7
Ubuntu
PHP vulnerabilities↗2025-02-26
▶
Oracle
Oracle Oracle Secure Backup Risk Matrix: General (PHP) — CVE-2024-8927↗2025-01-15
▶
Ubuntu
PHP vulnerabilities↗2024-11-14
▶
Microsoft
cgi.force_redirect configuration is bypassable due to the environment variable collision↗2024-10-08
▶
Red Hat
php: cgi.force_redirect configuration is bypassable due to the environment variable collision↗2024-10-07
▶