CVE-2024-11234: php — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-11234

CVSS 7.2 · High EPSS 1,1%

Kerentanan Improper Input Validation pada php. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

Rincian

Terbit di NVD: 24 November 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 65,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
php	php	Versi 8.1.0 hingga sebelum 8.1.31
php	php	Versi 8.2.0 hingga sebelum 8.2.26
php	php	Versi 8.3.0 hingga sebelum 8.3.14

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2 exploit · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
https://security.netapp.com/advisory/ntap-20241220-0008/

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.