Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-2756

__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: affected

  • 8.1.* to < 8.1.28affected
  • 8.2.* to < 8.2.18affected
  • 8.3.* to < 8.3.5affected

References