CVE-2024-8927
MediumSummary
Vulnerability in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. The HTTP_REDIRECT_STATUS variable used to check if CGI is run by the HTTP server can be controlled by the request submitter via HTTP headers.
Risk Assessment
An attacker can impersonate the CGI environment, potentially leading to security bypass or code execution in an unexpected context.
Recommendation
Update PHP to version 8.1.30, 8.2.24, 8.3.12 or later. Restrict access to CGI scripts.
Original NVD description (English source)
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP hea