Erroneous parsing of multipart form data (PHP Group PHP)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.94 % · percentile 61 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- php
- NVD status
- Modified
Description
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
Weaknesses (CWE)
- CWE-444 — Inconsistent Interpretation of HTTP Requests
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N | php |
| CVSS 3.1 | LOW 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N | NVD · security@php.net (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-49488
- GCVE · GCVE-0-2024-8925
CERT-FR advisories
- CERTFR-2024-AVI-0818 — Multiples vulnérabilités dans PHP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.30cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.2.0 < 8.2.24cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.12
Affected products
| Product | Versions |
|---|---|
| PHP Group · PHP | affected 8.1.* < 8.1.30 ; affected 8.2.* < 8.2.24 ; affected 8.3.* < 8.3.12 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |