Search for vulnerabilities
Vulnerability details: VCID-e7hs-zsy9-6ug1
Vulnerability ID VCID-e7hs-zsy9-6ug1
Aliases CVE-2024-8925
Summary In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-1286 Improper Validation of Syntactic Correctness of Input
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8925.json
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00032 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-8925
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 3.1 https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
ssvc Track https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
cvssv3 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-8925
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2024-8925
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8925.json
https://api.first.org/data/v1/epss?cve=CVE-2024-8925
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8925
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2317049 https://bugzilla.redhat.com/show_bug.cgi?id=2317049
cpe:2.3:a:php-fpm:php-fpm:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:php-fpm:php-fpm:*:*:*:*:*:*:*:*
CVE-2024-8925 https://nvd.nist.gov/vuln/detail/CVE-2024-8925
GHSA-9pqp-7h25-4f32 https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
GLSA-202501-11 https://security.gentoo.org/glsa/202501-11
RHSA-2024:10949 https://access.redhat.com/errata/RHSA-2024:10949
RHSA-2024:10950 https://access.redhat.com/errata/RHSA-2024:10950
RHSA-2024:10951 https://access.redhat.com/errata/RHSA-2024:10951
RHSA-2024:10952 https://access.redhat.com/errata/RHSA-2024:10952
RHSA-2025:7315 https://access.redhat.com/errata/RHSA-2025:7315
USN-7049-1 https://usn.ubuntu.com/7049-1/
USN-7049-2 https://usn.ubuntu.com/7049-2/
USN-7049-3 https://usn.ubuntu.com/7049-3/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8925.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-08T12:56:50Z/ Found at https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-8925
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-8925
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0512
EPSS Score 0.00029
Published At April 7, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-09-26T08:25:31.382165+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 34.0.1