CVE-2024-4577

CRITICAL CISA KEV

CVSS v3

9.8

CRITICAL

EPSS Score

—

exploit probability

CISA KEV

Yes

known exploited

Exploitation

—

SSVC status

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

CISA Known Exploited Vulnerability

Date Added: 6/12/2024
Patch Due Date: 7/3/2024
Ransomware Use: Known
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Technical Details

CVSS v3 Vector: 3.1
Published: 6/9/2024
Last Modified: 11/3/2025

Frequently Asked Questions

What is CVE-2024-4577?

Is CVE-2024-4577 actively exploited?

Yes. CVE-2024-4577 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 7/3/2024.

What is the CVSS score for CVE-2024-4577?

CVE-2024-4577 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string 3.1.

Is CVE-2024-4577 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs

Back to CVE Database