Medium severity · published Oct 2, 2020
CVE-2020-7070
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded
5.3
CVSS
5%
EPSS
No
On KEV
Description
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
7.2.0 before 7.2.34; 7.3.0 before 7.3.23; 7.4.0 before 7.4.11 · source: NVD
CD
Clustered Data Ontap · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
9.0; 10.0 · source: NVD
FE
Fedora · Fedoraproject
31; 32; 33 · source: NVD
LE
Leap · Opensuse
15.1; 15.2 · source: NVD
TE
Tenable.sc · Tenable
before 5.19.0 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 16.04; 18.04; 20.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7070
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7070
Third Party Advisory
http://cve.circl.lu/cve/CVE-2020-8184
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html
Issue Tracking
https://bugs.php.net/bug.php?id=79699
Exploit
https://hackerone.com/reports/895727
Mailing List
https://lists.debian.org/debian-lts-announce/2020/10/msg00008.html
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability