Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim’s browser which is treated as a __Host- or __Secure- cookie by PHP applications.

References

www.openwall.com/lists/oss-security/2024/04/12/11

github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4

lists.debian.org/debian-lts-announce/2024/05/msg00005.html

security.netapp.com/advisory/ntap-20240510-0008/

vulnrichment 2

alpinelinux 2

ubuntucve 2

debiancve 2

osv 18

openvas 34

redhatcve 2

cloudlinux 1

nessus 71

cve 2

cvelist 2

debian 5

slackware 2

mageia 2

fedora 6

checkpoint_advisories 1

altlinux 3

nvd 1

redos 2

prion 1

veracode 1

githubexploit 1

cbl_mariner 2

freebsd 1

suse 2

ubuntu 4

gentoo 2

almalinux 4

redhat 4

oraclelinux 4

rocky 2

ibm 1

hp 1

oracle 1

vulnrichment

CVE-2024-2756 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

2024-04-29 03:34:16

CVE-2022-31629 $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

2022-09-28 22:25:10

alpinelinux

CVE-2024-2756

2024-04-29 04:15:07

CVE-2022-31629

2022-09-28 23:15:10

ubuntucve

CVE-2024-2756

2024-04-16 00:00:00

CVE-2022-31629

2022-09-28 00:00:00

debiancve

CVE-2024-2756

2024-04-29 04:15:07

CVE-2022-31629

2022-09-28 23:15:10

osv

BIT-php-2024-2756

2024-05-14 07:29:36

BIT-php-2022-31629

2024-03-06 11:03:40

CVE-2022-31629

2022-09-28 23:15:10

openvas

PHP 8.1.11 < 8.1.28, 8.2.x < 8.2.18, 8.3.x < 8.3.6 Security Update (GHSA-wpj3-hf5j-x4v4) - Linux

2024-04-15 00:00:00

PHP 8.1.11 < 8.1.28, 8.2.x < 8.2.18, 8.3.x < 8.3.6 Security Update (GHSA-wpj3-hf5j-x4v4) - Windows

2024-04-15 00:00:00

openSUSE: Security Advisory for php8 (SUSE-SU-2024:1446-1)

2024-04-27 00:00:00

redhatcve

CVE-2024-2756

2024-04-15 08:56:16

CVE-2022-31629

2022-10-13 14:29:56

cloudlinux

php: Fix of 2 CVEs

2024-05-09 18:56:08

nessus

CBL Mariner 2.0 Security Update: php (CVE-2024-2756)

2024-07-03 00:00:00

SUSE SLES12 Security Update : php74 (SUSE-SU-2024:1445-1)

2024-04-29 00:00:00

SUSE SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2024:1444-1)

2024-04-29 00:00:00

cve

CVE-2024-2756

2024-04-29 04:15:07

CVE-2022-31629

2022-09-28 23:15:10

cvelist

CVE-2024-2756 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

2024-04-29 03:34:16

CVE-2022-31629 $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

2022-09-28 22:25:10

debian

[SECURITY] [DLA 3810-1] php7.3 security update

2024-05-07 23:30:41

[SECURITY] [DSA 5277-1] php7.4 security update

2022-11-13 18:52:43

[SECURITY] [DSA 5661-1] php8.2 security update

2024-04-15 19:27:08

slackware

[slackware-security] php

2024-04-12 19:36:41

[slackware-security] php

2022-09-30 18:00:43

mageia

Updated php packages fix security vulnerabilities

2024-04-13 19:56:38

Updated php packages fix security vulnerability

2022-10-08 23:22:22

fedora

[SECURITY] Fedora 39 Update: php-8.2.18-1.fc39

2024-04-19 01:18:35

[SECURITY] Fedora 38 Update: php-8.2.18-1.fc38

2024-04-19 02:53:20

[SECURITY] Fedora 40 Update: php-8.3.6-1.fc40

2024-04-19 21:43:53

checkpoint_advisories

PHP Authentication Bypass (CVE-2022-31629)

2022-11-24 00:00:00

altlinux

Security fix for the ALT Linux 10 package php8.0 version 8.0.24-alt1

2022-10-13 00:00:00

Security fix for the ALT Linux 10 package php8.2 version 8.1.11-alt1

2022-09-30 00:00:00

Security fix for the ALT Linux 10 package php8.1 version 8.1.11-alt1

2022-10-11 00:00:00

nvd

CVE-2022-31629

2022-09-28 23:15:10

redos

ROS-20240730-07

2024-07-30 00:00:00

ROS-20240816-10

2024-08-16 00:00:00

prion

Code injection

2022-09-28 23:15:00

veracode

Insecure Cookie

2022-09-30 11:10:30

githubexploit

Exploit for Improper Input Validation in Php

2022-10-07 08:15:23

cbl_mariner

CVE-2022-31629 affecting package php 7.4.14-3

2024-09-17 03:30:15

CVE-2024-2756 affecting package php for versions less than 8.1.28-1

2024-05-06 17:48:02

freebsd

php -- Multiple vulnerabilities

2024-04-11 00:00:00

suse

Security update for php7 (moderate)

2022-11-01 00:00:00

Security update for php8 (important)

2022-10-19 00:00:00

ubuntu

PHP vulnerabilities

2024-05-02 00:00:00

PHP vulnerabilities

2024-04-29 00:00:00

PHP vulnerabilities

2022-11-08 00:00:00

gentoo

PHP: Multiple Vulnerabilities

2022-11-19 00:00:00

PHP: Multiple Vulnerabilities

2024-08-12 00:00:00

almalinux

Moderate: php security update

2023-02-28 00:00:00

Moderate: php:7.4 security update

2023-05-16 00:00:00

Moderate: php:8.1 security update

2023-05-09 00:00:00

redhat

(RHSA-2023:2903) Moderate: php:7.4 security update

2023-05-16 05:57:44

(RHSA-2023:2417) Moderate: php:8.1 security update

2023-05-09 05:10:10

(RHSA-2023:0965) Moderate: php security update

2023-02-28 07:53:30

oraclelinux

8.1 security update

2023-05-15 00:00:00

php security update

2023-02-28 00:00:00

php:7.4 security update

2023-05-24 00:00:00

rocky

php security update

2023-04-06 15:53:36

php:8.0 security update

2023-02-22 01:08:53

ibm

Security Bulletin: Vulnerabilities in PHP may affect IBM Spectrum Sentinel Anomaly Scan Engine (CVE-2021-21703, CVE-2021-21708, CVE-2021-21707, CVE-2022-31629, CVE-2022-31628)

2022-12-16 17:01:05

HP Device Manager Security Updates

2023-04-13 00:00:00

oracle

Oracle Critical Patch Update Advisory - January 2023

2023-01-17 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

7.9

Confidence

High

EPSS

0.006

Percentile

79.3%

JSON

Related for NVD:CVE-2024-2756

vulnrichment2 alpinelinux2 ubuntucve2 debiancve2 osv18 openvas34 redhatcve2 cloudlinux1 nessus71 cve2 cvelist2 debian5 slackware2 mageia2 fedora6 checkpoint_advisories1 altlinux3 nvd1 redos2 prion1 veracode1 githubexploit1 cbl_mariner2 freebsd1 suse2 ubuntu4 gentoo2 almalinux4 redhat4 oraclelinux4 rocky2 ibm1 hp1 oracle1