CVE-2020-7070

Katalog CVE

CVSS 5.3 · Medium EPSS 5,0%

Kerentanan Improper Input Validation pada php, fedoraproject fedora +5 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Rincian

Terbit di NVD

2 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-565: Reliance on Cookies without Validation and Integrity Checking

EPSS (30 hari)

5,0% peluang dieksploitasi; lebih tinggi dari 92,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.php.net/bug.php?id=79699 issue tracking · advisory vendor
• http://cve.circl.lu/cve/CVE-2020-8184 advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html mailing list · advisory pihak ketiga
• https://hackerone.com/reports/895727 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/10/msg00008.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202012-16 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20201016-0001/ advisory pihak ketiga
• https://usn.ubuntu.com/4583-1/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4856 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html not applicable · advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-14 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EA...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPO...