PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 5.0%
exploitation probability
5.0%top 9% of all CVEs
observed exploitation
nono source reports it
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
PHP Group · PHPReferences
http://cve.circl.lu/cve/CVE-2020-8184http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.htmlhttps://bugs.php.net/bug.php?id=79699https://hackerone.com/reports/895727https://lists.debian.org/debian-lts-announce/2020/10/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/https://security.gentoo.org/glsa/202012-16https://security.netapp.com/advisory/ntap-20201016-0001/https://usn.ubuntu.com/4583-1/