CVE-2022-31629 — Improper Input Validation in Group PHP

CWE-20 — Improper Input ValidationCWE-1284 — Improper Validation of Specified Quantity in Input14 documents9 sources
Severity
6.5MEDIUMNVD
OSV5.5
EPSS
15.4%
top 5.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
PHP Group PHPPHPDebian Linux+1 more
Timeline
PublishedSep 28
Latest updateApr 12

Description

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDphp/php8.0.0 — 8.0.24+2
▶CVEListV5php_group/php8.1.* — 8.1.28+5

Also affects: Debian Linux 10.0, 11.0, Fedora 35, 36, 37

🔴Vulnerability Details

5
OSV
php7.0 vulnerabilities↗2023-03-02
▶
OSV
php7.2, php7.4, php8.1 vulnerabilities↗2022-11-08
▶
GHSA
GHSA-c43m-486j-j32p: In PHP versions before 7↗2022-09-29
▶
CVEList
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities↗2022-09-28
▶
OSV
CVE-2022-31629: In PHP versions before 7↗2022-09-28
▶

📋Vendor Advisories

8
Red Hat
php: host/secure cookie bypass due to partial CVE-2022-31629 fix↗2024-04-12
▶
Microsoft
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix↗2024-04-09
▶
Ubuntu
PHP vulnerabilities↗2023-03-02
▶
Oracle
Oracle Oracle Communications Risk Matrix: Platform (PHP) — CVE-2022-31629↗2023-01-15
▶
Ubuntu
PHP vulnerabilities↗2022-11-08
▶
CVE-2022-31629 — Improper Input Validation in Group PHP | cvebase