← Back

CVE-2020-7070

nvd nist
Published: Oct 2, 2020Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Affected (17)

Products: Php: Php · Fedoraproject: Fedora · Debian: Debian Linux · +4 more
Show all products
Php: Php · Fedoraproject: Fedora · Debian: Debian Linux · Opensuse: Leap · Canonical: Ubuntu Linux · Netapp: Clustered Data Ontap · Tenable: Tenable.sc
Php
1 product
Php
Fedoraproject
1 product
Fedora
Debian
1 product
Debian Linux
Opensuse
1 product
Leap
Canonical
1 product
Ubuntu Linux
Netapp
1 product
Clustered Data Ontap
Tenable
1 product
Tenable.sc
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Php
Php
From 7.2.0 to 7.2.34
Php
From 7.3.0 to 7.3.23
Php
From 7.4.0 to 7.4.11
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 31
Fedora
Version 32
Fedora
Version 33
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 9.0
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Opensuse
Leap
Version 15.1
Leap
Version 15.2
Configuration E
5 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 12.04
Ubuntu Linux
Version 14.04
Ubuntu Linux
Version 16.04
Ubuntu Linux
Version 18.04
Ubuntu Linux
Version 20.04
Configuration F
1 vulnerable
Vulnerable SoftwareAffected Versions
Clustered Data Ontap
All versions
Configuration G
1 vulnerable
Vulnerable SoftwareAffected Versions
Tenable.sc
Before 5.19.0

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-565
Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

References (30)

Source: security@php.net
Third Party Advisory
Source: security@php.net
Mailing ListThird Party Advisory
Source: security@php.net
Mailing ListThird Party Advisory
Source: security@php.net
Issue TrackingVendor Advisory
Source: security@php.net
ExploitThird Party Advisory
Source: security@php.net
Mailing ListThird Party Advisory
Source: security@php.net
Source: security@php.net
Source: security@php.net
Source: security@php.net
Third Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
Not ApplicableThird Party Advisory
Source: security@php.net
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not ApplicableThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.