HTTP_REDIRECT_STATUS variable manipulation can lead to arbitrary file inclusion in PHP
CVE-2024-8927
7.5HIGH
What is CVE-2024-8927?
A security concern exists in specific versions of PHP where the HTTP_REDIRECT_STATUS variable can be manipulated via HTTP headers. This manipulation can prevent the cgi.force_redirect option from being applied correctly, potentially allowing unauthorized users to exploit this behavior for arbitrary file inclusion. Systems running PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, and 8.3.* before 8.3.12 may be affected, necessitating immediate action to update and secure installations.
Affected Version(s)
PHP 8.1.* < 8.1.30
PHP 8.2.* < 8.2.24
PHP 8.3.* < 8.3.12