CVE-2024-11234CWE-20

Configuring a proxy in a stream context might allow for CRLF injection in URIs

Medium · published November 24, 2024

CVSS v3.1
4.8
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01108 · 65.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-11-24T00:57Z
EPSS history
Timeline
  • 24 NOV 00:57Z
    Configuring a proxy in a stream context might allow for CRLF injection in URIs
    cvelistv5