NetSight
IP …
medium4.3

CVE-2020-7070

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-dec…

Impact

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Affected products

VendorProductAffected versions
PhpPhp
from 7.2.0 before 7.2.34
from 7.3.0 before 7.3.23
from 7.4.0 before 7.4.11
FedoraprojectFedora
Versions 31, 32, 33
DebianDebian Linux
Versions 9.0, 10.0
OpensuseLeap
Versions 15.1, 15.2
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 20.04
NetappClustered Data Ontap
All versions
TenableTenable.Sc
before 5.19.0

Weakness classification

CWE-20CWE-565

References