CVE-2024-4577

EUVD-2024-44188
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
phpCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
phpphp
8.1.0 ≤
𝑥
< 8.1.29
phpphp
8.2.0 ≤
𝑥
< 8.2.20
phpphp
8.3.0 ≤
𝑥
< 8.3.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
7.4.33-1+deb11u5
fixed
bullseye (security)
7.4.33-1+deb11u9
fixed
php8.2
bookworm
8.2.29-1~deb12u1
fixed
bookworm (security)
8.2.29-1~deb12u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
focal
dne
jammy
dne
mantic
dne
noble
dne
trusty
not-affected
php7.0
focal
dne
jammy
dne
mantic
dne
noble
dne
xenial
not-affected
php7.2
bionic
not-affected
focal
dne
jammy
dne
mantic
dne
noble
dne
php7.4
focal
not-affected
jammy
dne
mantic
dne
noble
dne
php8.1
focal
dne
jammy
not-affected
mantic
dne
noble
dne
php8.2
focal
dne
jammy
dne
mantic
not-affected
noble
dne
php8.3
focal
dne
jammy
dne
mantic
dne
noble
not-affected
References