In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Php
  • Php
Redhat
  • Enterprise Linux

Configuration 1 [-]

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
php:8.0-8070020230118114629.ef331662 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:0848 2023-02-21T00:00:00Z
php:7.4-8080020230118140634.cc342424 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:2903 2023-05-16T00:00:00Z
Red Hat Enterprise Linux 9
php-0:8.0.27-1.el9_1 cpe:/a:redhat:enterprise_linux:9 RHSA-2023:0965 2023-02-28T00:00:00Z
php:8.1-9020020230120141750.9 cpe:/a:redhat:enterprise_linux:9 RHSA-2023:2417 2023-05-09T00:00:00Z
References
Link Providers
http://www.openwall.com/lists/oss-security/2024/04/12/11 cve-icon cve-icon
https://bugs.php.net/bug.php?id=81727 cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSJVPJTX7T3J5V7XHR4MFNHZGP44R5XE/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-31629 cve-icon
https://security.gentoo.org/glsa/202211-03 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20221209-0001/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-31629 cve-icon
https://www.debian.org/security/2022/dsa-5277 cve-icon cve-icon
History

Tue, 29 Oct 2024 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: php

Published: 2022-09-28T22:25:10.116784Z

Updated: 2024-10-29T15:05:18.365Z

Reserved: 2022-05-25T00:00:00

Link: CVE-2022-31629

cve-icon Vulnrichment

Updated: 2024-08-03T07:26:00.718Z

cve-icon NVD

Status : Modified

Published: 2022-09-28T23:15:10.540

Modified: 2024-11-21T07:04:53.460

Link: CVE-2022-31629

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-09-29T00:00:00Z

Links: CVE-2022-31629 - Bugzilla