CVE-2020-7070CWE-20

PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

Medium · published October 2, 2020

CVSS v3.1
4.3
EPSS
5%
Percentile
92.2
In the wild
Unconfirmed
What it is

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.05029 · 92.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-10-02T14:14Z
EPSS history
Timeline
  • 02 OCT 14:14Z
    PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
    cvelistv5