CVE-2024-8927: fallo de gravedad alta en PHP
cgi.force_redirect configuration is bypassable due to the environment variable collision
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 1.1%
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
PHP Group · PHPCVEs relacionadas — PHP
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-109619CRITICALRCE via stale global stateEPSS 100.0%KEVCVE-2026-109618CRITICALRCE via OOM corruptionEPSS 100.0%KEVCVE-2024-4577CRITICALArgument Injection in PHP-CGIEPSS 100.0%KEVCVE-2022-31626HIGHmysqlnd/pdo password buffer overflowEPSS 58.1%CVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.6%CVE-2024-2756MEDIUM__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixEPSS 38.1%