CVE-2024-2756

Description

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

How to fix CVE-2024-2756

To remediate CVE-2024-2756, upgrade the affected package to a fixed version below.

Bitnami/libphp—upgrade to 8.1.28 or later
—upgrade to 8.1.28 or later
—upgrade to 8.1.28 or later
—upgrade to 7.3.31-1~deb10u6 or later
—upgrade to 7.4.33-1+deb11u5 or later
—upgrade to 8.2.18-1~deb12u1 or later

Is CVE-2024-2756 being exploited?

Moderate — EPSS is 8.7%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (6)

from 0, < 8.1.28, >= 8.2.0, < 8.2.18, >= 8.3.0, < 8.3.5
from 0, < 8.1.28, >= 8.2.0, < 8.2.18, >= 8.3.0, < 8.3.5
from 0, < 8.1.28, >= 8.2.0, < 8.2.18, >= 8.3.0, < 8.3.5
from 0, < 7.3.31-1~deb10u6
from 0, < 7.4.33-1+deb11u5
from 0, < 8.2.18-1~deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N