CVE-2024-8925

Oct. 16, 2024, 6:53 p.m.

5.3
Medium

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Product(s) Impacted

Vendor Product Versions
Php-fpm
  • Php-fpm
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a php-fpm php-fpm / / / / / / / /
a php-fpm php-fpm / / / / / / / /
a php-fpm php-fpm / / / / / / / /

References

https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32

Tags

security@php.net
NVD-CWE-noinfo
2024-10-08
CVE-2024-8925

CVSS Score

5.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

    View Vector String

Timeline

Published: Oct. 8, 2024, 4:15 a.m.
Last Modified: Oct. 16, 2024, 6:53 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@php.net

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.