Cookie Injection

2020-10-0206:07:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

75.1%

JSON

php7 is vulnerable to cookie injection. The vulnerability exists as cookie names are url-decoded, allowing cookies with prefixes such as __Host to be forged.

CPENameOperatorVersion
php7:3.12eq7.3.18-r0
php7.4:focaleq7.4.3-4ubuntu1
php7.4:focaleq7.4.3-4ubuntu2.2
php7.4:focaleq7.4.3-4ubuntu2.3
php7.0:xenialeq7.0.4-7ubuntu2
php7.0:xenialeq7.0.33-0ubuntu0.16.04.15
php7.2:bioniceq7.2.24-0ubuntu0.18.04.6
php7.2:bioniceq7.2.3-1ubuntu1
php7.4:groovyeq7.4.5-1ubuntu2
php7.4:groovyeq7.4.9-1ubuntu1

Name	Operator	Version
php7:3.12	eq	7.3.18-r0
php7.4:focal	eq	7.4.3-4ubuntu1
php7.4:focal	eq	7.4.3-4ubuntu2.2
php7.4:focal	eq	7.4.3-4ubuntu2.3
php7.0:xenial	eq	7.0.4-7ubuntu2
php7.0:xenial	eq	7.0.33-0ubuntu0.16.04.15
php7.2:bionic	eq	7.2.24-0ubuntu0.18.04.6
php7.2:bionic	eq	7.2.3-1ubuntu1
php7.4:groovy	eq	7.4.5-1ubuntu2
php7.4:groovy	eq	7.4.9-1ubuntu1