CVE-2024-8925

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-8925", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2024-09-17T03:59:29.523Z", "datePublished": "2024-10-08T03:35:02.673Z", "dateUpdated": "2025-11-03T22:33:05.003Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [{"lessThan": "8.1.30", "status": "affected", "version": "8.1.*", "versionType": "semver"}, {"lessThan": "8.2.24", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.12", "status": "affected", "version": "8.3.*", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mihail Kirov"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In PHP versions<span style=\"background-color: var(--wht);\">&nbsp;8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, e</span>rroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.&nbsp;</p><br><br>"}], "value": "In PHP versions\u00a08.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior."}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2024-10-08T03:35:02.673Z"}, "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32"}], "source": {"discovery": "EXTERNAL"}, "title": "Erroneous parsing of multipart form data", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-444", "lang": "en", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "affected": [{"vendor": "php", "product": "php", "cpes": ["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.1.0", "status": "affected", "lessThan": "8.1.30", "versionType": "semver"}, {"version": "8.2.0", "status": "affected", "lessThan": "8.2.24", "versionType": "semver"}, {"version": "8.3.0", "status": "affected", "lessThan": "8.3.12", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T12:56:50.614930Z", "id": "CVE-2024-8925", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T17:56:24.654Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241101-0003/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:33:05.003Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8925", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-08T12:56:50.614930Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"], "vendor": "php", "product": "php", "versions": [{"status": "affected", "version": "8.1.0", "lessThan": "8.1.30", "versionType": "semver"}, {"status": "affected", "version": "8.2.0", "lessThan": "8.2.24", "versionType": "semver"}, {"status": "affected", "version": "8.3.0", "lessThan": "8.3.12", "versionType": "semver"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T12:56:56.974Z"}}], "cna": {"title": "Erroneous parsing of multipart form data", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mihail Kirov"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.1.*", "lessThan": "8.1.30", "versionType": "semver"}, {"status": "affected", "version": "8.2.*", "lessThan": "8.2.24", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.12", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In PHP versions\u00a08.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.", "supportingMedia": [{"type": "text/html", "value": "<p>In PHP versions<span style=\"background-color: var(--wht);\">&nbsp;8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, e</span>rroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.&nbsp;</p><br><br>", "base64": false}]}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2024-10-08T03:35:02.673Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8925", "state": "PUBLISHED", "dateUpdated": "2025-03-17T17:56:24.654Z", "dateReserved": "2024-09-17T03:59:29.523Z", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "datePublished": "2024-10-08T03:35:02.673Z", "assignerShortName": "php"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "PHP", "vendor": "PHP Group", "versions": [{"lessThan": "8.1.30", "status": "affected", "version": "8.1.*", "versionType": "semver"}, {"lessThan": "8.2.24", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.12", "status": "affected", "version": "8.3.*", "versionType": "semver"}]}], "source": "security@php.net"}, {"affectedData": [{"cpes": ["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "php", "vendor": "php", "versions": [{"lessThan": "8.1.30", "status": "affected", "version": "8.1.0", "versionType": "semver"}, {"lessThan": "8.2.24", "status": "affected", "version": "8.2.0", "versionType": "semver"}, {"lessThan": "8.3.12", "status": "affected", "version": "8.3.0", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "0AE1547D-26D1-4BD3-9EF8-B0E61BB7FFCB", "versionEndExcluding": "8.1.30", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "01D71D50-4234-4537-984F-DB2A675EDA24", "versionEndExcluding": "8.2.24", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "3236DC72-ADB3-44C3-8A19-4EC37B9FFDD7", "versionEndExcluding": "8.3.12", "versionStartIncluding": "8.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In PHP versions\u00a08.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior."}, {"lang": "es", "value": "En las versiones de PHP 8.1.* anteriores a 8.1.30, 8.2.* anteriores a 8.2.24, 8.3.* y anteriores a 8.3.12, el an\u00e1lisis err\u00f3neo de los datos de un formulario de varias partes incluidos en una solicitud HTTP POST podr\u00eda provocar que no se procesen los datos leg\u00edtimos. Esto podr\u00eda provocar que un atacante malintencionado capaz de controlar parte de los datos enviados pudiera excluir parte de otros datos, lo que podr\u00eda provocar un comportamiento err\u00f3neo de la aplicaci\u00f3n."}], "id": "CVE-2024-8925", "lastModified": "2026-06-17T08:23:34.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security@php.net", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-8925", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-08T12:56:50.614930Z", "version": "2.0.3"}}]}, "published": "2024-10-08T04:15:09.450", "references": [{"source": "security@php.net", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241101-0003/"}], "sourceIdentifier": "security@php.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-444"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:10951", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "php:8.2-8100020241112130045.f7998665", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10952", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "php:7.4-8100020241113075828.f7998665", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10949", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "php:8.2-9050020241112094217.9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10950", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "php:8.1-9050020241112144108.9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2025:7315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "php-0:8.0.30-2.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "php: Erroneous parsing of multipart form data", "id": "2317049", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317049"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "verified"}, "cwe": "CWE-1286", "details": ["In PHP versions\u00a08.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.", "A flaw was found in PHP's parsing of multipart form data contents, which affects both file and input form data. This may lead to legitimate data not being processed, violating data integrity. For example, if a multipart form data payload contains a valid prefix 'X' of the defined boundary B such that 5Kib < |X| < |B| < 8Kib, the logic responsible for parsing and storing the multipart payload fails to correctly extract the contents between two boundaries."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-8925", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "php:8.0/php", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2024-10-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-8925\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-8925\nhttps://github.com/php/php-src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1\nhttps://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32"], "threat_severity": "Moderate"}

{}