CVE-2024-8926

Public on 2024-09-27

Modified on 2024-09-27

Description

Bypass of CVE-2024-4577, Parameter Injection Vulnerability

NOTE: Fixed in 8.3.12, 8.2.24
NOTE: https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq
NOTE: https://github.com/php/php-src/commit/abcfd980bfa03298792fd3aba051c78d52f10642 (PHP-8.2.24)

Severity

Medium

See what this means

CVSS v3 Base Score

6.5

See breakdown

Affected Packages

Platform	Package	Status
Amazon Linux 1	php	No Fix Planned
Amazon Linux 2 - Core	php	Not Affected
Amazon Linux 2 - Php8.1 Extra	php	Not Affected
Amazon Linux 2 - Php8.2 Extra	php	Not Affected
Amazon Linux 1	php56	No Fix Planned
Amazon Linux 2023	php8.1	Not Affected
Amazon Linux 2023	php8.2	Not Affected

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	CVSSv3	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2024-8926 Mitre: CVE-2024-8926