CVE-2024-2756

Due to an incomplete fix to  CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host-or __Secure-cookie by PHP applications.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
phpCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
7.4.33-1+deb11u5
fixed
bullseye (security)
7.4.33-1+deb11u9
fixed
php8.2
bookworm
8.2.29-1~deb12u1
fixed
bookworm (security)
8.2.29-1~deb12u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
dne
trusty
needs-triage
php7.0
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
dne
xenial
Fixed 7.0.33-0ubuntu0.16.04.16+esm9
released
php7.2
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
dne
bionic
Fixed 7.2.24-0ubuntu0.18.04.17+esm3
released
php7.4
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
dne
focal
Fixed 7.4.3-4ubuntu2.22
released
php8.1
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
dne
jammy
Fixed 8.1.2-1ubuntu2.17
released
focal
dne
php8.2
questing
dne
plucky
dne
oracular
dne
noble
dne
mantic
Fixed 8.2.10-2ubuntu2.1
released
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
php8.3
questing
dne
plucky
dne
oracular
Fixed 8.3.6-0maysync1
released
noble
Fixed 8.3.6-0maysync1
released
mantic
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
dne
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2024/04/12/11
https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4
https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html
https://security.netapp.com/advisory/ntap-20240510-0008/
http://www.openwall.com/lists/oss-security/2024/04/12/11
https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4
https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/
https://security.netapp.com/advisory/ntap-20240510-0008/