cve.bz

CVE-2022-31629

6.5 mediumEPSS 50%

Medium (6.5). EPSS 50% chance of exploitation in the next 30 days.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS
50% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWEs
CWE-20, CWE-1284
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON