CVE-2024-2756 Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix

2024-04-2903:34:16

CWE-20

php

github.com

cve-2024-2756

network attackers

same-site

insecure cookie

php applications

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

6.7 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.3%

JSON

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim’s browser which is treated as a __Host- or __Secure- cookie by PHP applications.

CNA Affected

[
  {
    "vendor": "PHP Group",
    "product": "PHP",
    "versions": [
      {
        "status": "affected",
        "version": "8.1.*",
        "lessThan": "8.1.28",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.2.*",
        "lessThan": "8.2.18",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.3.*",
        "lessThan": "8.3.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "affected"
  }
]