CVSS 3.1 Score 3.7 of 10 (low)


Published Feb 1, 2024
Updated: Feb 9, 2024
CWE ID 436


CVE-2024-24754 is a vulnerability that affects Bref, a tool that enables serverless PHP on AWS Lambda. This vulnerability occurs when Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the $files or $parsedBody arrays. The difference in the body parsing compared to plain PHP when keys ending with an open square bracket ([) are used could lead to vulnerabilities and undefined behaviors depending on the application logic. The vulnerability has been patched in version 2.1.13 of Bref.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-24754 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options