Security Advisory

CVE-2020-7070

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2020-10-02 14:14:45

Last updated 2024-09-16 16:28:36

Assigner php

State PUBLISHED

Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

← Browse all CVEs View on cve.org ↗