Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2020-7070

PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

  • 7.3.x to < 7.3.23affected
  • 7.4.x to < 7.4.11affected
  • 7.2.x to < 7.2.34affected

References