Read the docs
TI-2022-13553 Aliases CVE-2022-31629GHSA-c43m-486j-j32p

$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

Priority MEDIUM 60CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.49569 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial PHP (PHP Group): 7.4.31, 8.0.24, 8.1.11Red Hat: 4 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHP7.4.X to before 7.4.31; 8.0.X to before 8.0.24; 8.1.X to before 8.1.117.4.31, 8.0.24, 8.1.11Patch availableCNA
  • PHP VendorPHP Group Affected 7.4.X to before 7.4.31; 8.0.X to before 8.0.24; 8.1.X to before 8.1.11 Fixed in 7.4.31, 8.0.24, 8.1.11 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*before 7.4.31; 8.0.0 to before 8.0.24; 8.1.0 to before 8.1.11VulnerablePHP
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions before 7.4.31; 8.0.0 to before 8.0.24; 8.1.0 to before 8.1.11 Vulnerable ·PHP
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA PHP (PHP Group) Fixed in 7.4.31, 8.0.24, 8.1.11

Red Hat 4 advisories

  • RHSA-2023:2903 Released 2023-05-16 · Red Hat rating Moderate
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47
  • RHSA-2023:2417 Released 2023-05-09 · Red Hat rating Moderate
    php:8.1 security update
    • Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.21-1.module+el9.1.0.z+15477+cb86791d.noarch::php:8.1, php-8.1.14-1.module+el9.2.0+17911+b059dfc2.aarch64::php:8.1, php-8.1.14-1.module+el9.2.0+17911+b059dfc2.ppc64le::php:8.1 +47
  • RHSA-2023:0965 Released 2023-02-28 · Red Hat rating Moderate
    php security update
    • Red Hat Enterprise Linux AppStream (v. 9) php-8.0.27-1.el9_1, php-bcmath-8.0.27-1.el9_1, php-cli-8.0.27-1.el9_1 +22
Show 1 more Red Hat advisories
  • RHSA-2023:0848 Released 2023-02-21 · Red Hat rating Moderate
    php:8.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.20-1.module+el8.6.0+13671+84712317.noarch::php:8.0, libzip-1.7.3-1.module+el8.6.0+13671+84712317.aarch64::php:8.0, libzip-1.7.3-1.module+el8.6.0+13671+84712317.ppc64le::php:8.0 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    PHP — FEDORA-2022-f204e1d0ed

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-13552 phar wrapper can occur dos when using quine gzip filePriority LOW 26
    Show all 2 records → Advisory →
  • Advisory ·

    PHP — FEDORA-2022-afdea1c747

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-13552 phar wrapper can occur dos when using quine gzip filePriority LOW 26
    Show all 2 records → Advisory →
Show 3 more groups
  • Advisory ·

    PHP — FEDORA-2022-0b77fbd9e7

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-13552 phar wrapper can occur dos when using quine gzip filePriority LOW 26
    Show all 2 records → Advisory →
  • Advisory ·

    PHP — GLSA-202211-03

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-13552 phar wrapper can occur dos when using quine gzip filePriority LOW 26
    Show all 2 records → Advisory →
  • Advisory ·

    PHP — DSA-5277

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-13552 phar wrapper can occur dos when using quine gzip filePriority LOW 26
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:0848, RHSA-2023:2903
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0965, RHSA-2023:2417

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31629
  2. 2026-10-03 Alias added: GHSA-c43m-486j-j32p

References

Exploit 1

Advisory 10

Other 1

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences