Search for vulnerabilities
Vulnerability details: VCID-y321-tcam-sybr
Vulnerability ID VCID-y321-tcam-sybr
Aliases CVE-2024-8927
Summary In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-1220 Insufficient Granularity of Access Control
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8927.json
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8927.json
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2024-8927
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp
ssvc Track https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-8927
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-8927
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8927.json
https://api.first.org/data/v1/epss?cve=CVE-2024-8927
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8927
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2317051 https://bugzilla.redhat.com/show_bug.cgi?id=2317051
cpe:2.3:a:php-fpm:php-fpm:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:php-fpm:php-fpm:*:*:*:*:*:*:*:*
CVE-2024-8927 https://nvd.nist.gov/vuln/detail/CVE-2024-8927
GHSA-94p6-54jq-9mwp https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp
GLSA-202501-11 https://security.gentoo.org/glsa/202501-11
RHSA-2024:10949 https://access.redhat.com/errata/RHSA-2024:10949
RHSA-2024:10950 https://access.redhat.com/errata/RHSA-2024:10950
RHSA-2024:10951 https://access.redhat.com/errata/RHSA-2024:10951
RHSA-2024:10952 https://access.redhat.com/errata/RHSA-2024:10952
RHSA-2025:7315 https://access.redhat.com/errata/RHSA-2025:7315
USN-7049-1 https://usn.ubuntu.com/7049-1/
USN-7049-2 https://usn.ubuntu.com/7049-2/
USN-7049-3 https://usn.ubuntu.com/7049-3/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8927.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-8927.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-08T12:50:40Z/ Found at https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-8927
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-8927
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0642
EPSS Score 0.00034
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-09-26T08:25:31.409474+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 34.0.1