CVE-2024-8925

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8925

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

I

n PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

References
Link Resource
https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html
https://security.netapp.com/advisory/ntap-20241101-0003/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
History

03 Nov 2025, 23:17

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html -
  • () https://security.netapp.com/advisory/ntap-20241101-0003/ -

19 Aug 2025, 16:25

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References () https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 - Exploit, Third Party Advisory () https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 - Exploit, Vendor Advisory
First Time Php php
Php
CPE cpe:2.3:a:php-fpm:php-fpm:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

17 Mar 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 3.1
CWE CWE-444

16 Oct 2024, 18:53

Type Values Removed Values Added
First Time Php-fpm
Php-fpm php-fpm
CPE cpe:2.3:a:php-fpm:php-fpm:*:*:*:*:*:*:*:*
References () https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 - () https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : 3.1 		v2 : unknown
v3 : 5.3
CWE NVD-CWE-noinfo

10 Oct 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) En las versiones de PHP 8.1.* anteriores a 8.1.30, 8.2.* anteriores a 8.2.24, 8.3.* anteriores a 8.3.12, el análisis erróneo de los datos de un formulario de varias partes incluidos en una solicitud HTTP POST podría provocar que no se procesen los datos legítimos. Esto podría provocar que un atacante malintencionado capaz de controlar parte de los datos enviados pudiera excluir parte de otros datos, lo que podría provocar un comportamiento erróneo de la aplicación.

08 Oct 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-08 04:15

Updated : 2025-11-03 23:17

NVD link : CVE-2024-8925

Mitre link : CVE-2024-8925

CVE.ORG link : CVE-2024-8925

JSON object : View

Products Affected

php

CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')