CVE-2020-7070 — Improper Input Validation in Group PHP

CWE-20 — Improper Input ValidationCWE-565 — Reliance on Cookies without Validation and Integrity Checking12 documents9 sources
Severity
5.3MEDIUMNVD
CNA4.3GHSA4.3OSV6.5
EPSS
26.1%
top 3.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
PHP Group PHPPHPTenable Tenable.sc+5 more
Timeline
PublishedOct 2
Latest updateSep 16

Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶NVDtenable/tenable.sc< 5.19.0
▶NVDphp/php7.2.0 — 7.2.34+2
▶CVEListV5php_group/php7.3.x — 7.3.23+2
▶Ubuntuphp5/php5< 5.5.9+dfsg-1ubuntu4.29+esm13
▶NVDopensuse/leap15.1, 15.2+1

Also affects: Debian Linux 10.0, 9.0, Fedora 31, 32, 33, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 20.04

🔴Vulnerability Details

5
GHSA
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent↗2022-09-16
▶
GHSA
GHSA-j7r5-hm2w-qqf9: In PHP versions 7↗2022-05-24
▶
OSV
php5, php7.0, php7.2, php7.4 vulnerabilities↗2020-10-14
▶
OSV
CVE-2020-7070: In PHP versions 7↗2020-10-02
▶
CVEList
PHP parses encoded cookie names so malicious `__Host-` cookies can be sent↗2020-10-02
▶

📋Vendor Advisories

4
Ubuntu
PHP vulnerabilities↗2020-10-27
▶
Ubuntu
PHP vulnerabilities↗2020-10-14
▶
Red Hat
php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server↗2020-06-14
▶
Debian
CVE-2020-7070: php7.4 - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, w...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-7070 php: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent [fedora-all]↗2020-10-06
▶
Bugzilla
CVE-2020-7070 php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server↗2020-10-06
▶
CVE-2020-7070 — Improper Input Validation in Group PHP | cvebase