CVE-2020-7070 - CVE House

Back to Database

Status published Medium CVE-2020-7070

PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

4.3 CVSS

Vulnerability Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-7070

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Reported by fletchto99 at gmail dot com

References

More from PHP Group

View All →

NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

Stream HTTP wrapper truncates redirect location to 1024 bytes

Stream HTTP wrapper header check might omit basic auth header

pgsql extension does not check for errors during escaping

Streams HTTP wrapper does not fail for headers with invalid name and no colon

Affected Vendor

PHP Group

View all reports →

Affected Software

PHP

Vulnerable Versions:

7.3.x, 7.4.x, 7.2.x

Timeline

Official Publish: October 2nd, 2020

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation