{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "state": "PUBLISHED", "cveId": "CVE-2022-31629", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "assignerShortName": "php", "dateUpdated": "2025-11-04T17:12:24.069Z", "dateReserved": "2022-05-25T00:00:00.000Z", "datePublished": "2022-09-28T22:25:10.116Z" }, "containers": { "cna": { "title": "$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities", "datePublic": "2022-09-27T00:00:00.000Z", "providerMetadata": { "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2024-05-01T17:09:26.439Z" }, "descriptions": [ { "lang": "en", "value": "In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications." } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "versions": [ { "version": "7.4.X", "status": "affected", "lessThan": "7.4.31", "versionType": "custom" }, { "version": "8.0.X", "status": "affected", "lessThan": "8.0.24", "versionType": "custom" }, { "version": "8.1.X", "status": "affected", "lessThan": "8.1.11", "versionType": "custom" } ] } ], "references": [ { "url": "https://bugs.php.net/bug.php?id=81727" }, { "name": "FEDORA-2022-0b77fbd9e7", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/" }, { "name": "FEDORA-2022-afdea1c747", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/" }, { "name": "FEDORA-2022-f204e1d0ed", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/" }, { "name": "DSA-5277", "tags": [ "vendor-advisory" ], "url": "https://www.debian.org/security/2022/dsa-5277" }, { "name": "GLSA-202211-03", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/202211-03" }, { "url": "https://security.netapp.com/advisory/ntap-20221209-0001/" }, { "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html" }, { "name": "FEDORA-2024-b46619f761", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/" }, { "name": "FEDORA-2024-39d50cc975", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSJVPJTX7T3J5V7XHR4MFNHZGP44R5XE/" }, { "name": "FEDORA-2024-5e8ae0def0", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/" }, { "name": "[oss-security] 20240412 PHP security releases 8.1.28, 8.2.18, & 8.3.6", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11" } ], "credits": [ { "lang": "en", "value": "reported by squarcina at gmail dot com" } ], "problemTypes": [ { "descriptions": [ { "type": "CWE", "lang": "en", "description": "CWE-20 Improper Input Validation", "cweId": "CWE-20" } ] } ], "x_generator": { "engine": "Vulnogram 0.0.9" }, "source": { "advisory": "https://bugs.php.net/bug.php?id=81727", "defect": [ "81727" ], "discovery": "EXTERNAL" }, "solutions": [ { "lang": "en", "value": "Upgrade to PHP 7.4.31, 8.0.24, or 8.1.11." } ] }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-1284", "lang": "en", "description": "CWE-1284 Improper Validation of Specified Quantity in Input" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-07-16T18:53:33.259759Z", "id": "CVE-2022-31629", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T15:05:18.365Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://bugs.php.net/bug.php?id=81727", "tags": [ "x_transferred" ] }, { "name": "FEDORA-2022-0b77fbd9e7", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/" }, { "name": "FEDORA-2022-afdea1c747", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/" }, { "name": "FEDORA-2022-f204e1d0ed", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/" }, { "name": "DSA-5277", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.debian.org/security/2022/dsa-5277" }, { "name": "GLSA-202211-03", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202211-03" }, { "url": "https://security.netapp.com/advisory/ntap-20221209-0001/", "tags": [ "x_transferred" ] }, { "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html" }, { "name": "FEDORA-2024-b46619f761", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/" }, { "name": "FEDORA-2024-39d50cc975", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSJVPJTX7T3J5V7XHR4MFNHZGP44R5XE/" }, { "name": "FEDORA-2024-5e8ae0def0", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/" }, { "name": "[oss-security] 20240412 PHP security releases 8.1.28, 8.2.18, & 8.3.6", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:12:24.069Z" } } ] } }