CVE-2020-7070
This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure.
Does this matter?
Lower severity and a low EPSS score (5.03%). Track it; it rarely justifies an emergency change on its own.
Description
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 5.03% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-565
- Affected
- php/php · fedoraproject/fedora · debian/debian linux · opensuse/leap · canonical/ubuntu linux · netapp/clustered data ontap · tenable/tenable.sc
- Source
- security@php.net
References
- http://cve.circl.lu/cve/CVE-2020-8184Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.htmlMailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=79699Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/895727Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/10/msg00008.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/
- https://security.gentoo.org/glsa/202012-16Third Party Advisory
- https://security.netapp.com/advisory/ntap-20201016-0001/Third Party Advisory
- https://usn.ubuntu.com/4583-1/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4856Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlNot Applicable, Third Party Advisory
- https://www.tenable.com/security/tns-2021-14Third Party Advisory
- http://cve.circl.lu/cve/CVE-2020-8184Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.htmlMailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=79699Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/895727Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/10/msg00008.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/
- https://security.gentoo.org/glsa/202012-16Third Party Advisory
- https://security.netapp.com/advisory/ntap-20201016-0001/Third Party Advisory
- https://usn.ubuntu.com/4583-1/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4856Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlNot Applicable, Third Party Advisory
- https://www.tenable.com/security/tns-2021-14Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.