VDB
DEBIAN-CVE-2020-7070
DEBIAN-CVE-2020-7070
PUBLISHED
CVSS 5.300000190734863 MEDIUM
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | php7.4 | 0, 0, 0 |
Exploit Intelligence
- Rapport_149185019.html (github-poc)
- cve_db.json (github-poc)
Timeline
- Oct 2, 2020 CVE Published
- Apr 28, 2026 CVE Updated