CVE-2024-8927
HIGHDescription
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
Is your site exposed to CVE-2024-8927?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| php | php |
| php | php |
| php | php |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2024-8927? +
How severe is CVE-2024-8927? +
What products are affected by CVE-2024-8927? +
How do I check if I'm vulnerable to CVE-2024-8927? +
Related Vulnerabilities
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, …
Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application …
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced …
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain …
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, …
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially …