CVE-2024-8927

cgi.force_redirect configuration is bypassable due to the environment variable collision

High · published October 8, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
64.1
In the wild
Unconfirmed
What it is

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01054 · 64.1th percentile
Published
2024-10-08T03:56Z
EPSS history
Timeline
  • 08 OCT 03:56Z
    cgi.force_redirect configuration is bypassable due to the environment variable collision
    cvelistv5