CWE-565
AllowedReliance on Cookies without Validation and Integrity Checking
Abstraction: Base · Status: Incomplete
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
102 vulnerabilities reference this CWE, most recent first.
GHSA-J224-7QR4-8646
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2023-09-25 19:37In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "centreon/centreon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "19.04.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-17104"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-17T22:14:43Z",
"nvd_published_at": "2019-10-08T13:15:00Z",
"severity": "HIGH"
},
"details": "In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.",
"id": "GHSA-j224-7qr4-8646",
"modified": "2023-09-25T19:37:21Z",
"published": "2022-05-24T16:58:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17104"
},
{
"type": "WEB",
"url": "https://github.com/centreon/centreon-archived/issues/7097"
},
{
"type": "WEB",
"url": "https://docs.centreon.com/current/en/administration/secure-platform.html#securing-the-apache-web-server"
},
{
"type": "PACKAGE",
"url": "https://github.com/centreon/centreon-archived"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2019/10/08/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Centreon Does Not Set HTTPOnly Flag"
}
GHSA-J7R5-HM2W-QQF9
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
{
"affected": [],
"aliases": [
"CVE-2020-7070"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-02T15:15:00Z",
"severity": "MODERATE"
},
"details": "In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.",
"id": "GHSA-j7r5-hm2w-qqf9",
"modified": "2022-05-24T17:30:05Z",
"published": "2022-05-24T17:30:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7070"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/895727"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=79699"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202012-16"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20201016-0001"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4583-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4856"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2021-14"
},
{
"type": "WEB",
"url": "http://cve.circl.lu/cve/CVE-2020-8184"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JQXW-84HX-6QJ5
Vulnerability from github – Published: 2026-05-13 21:32 – Updated: 2026-06-09 12:32Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
{
"affected": [],
"aliases": [
"CVE-2026-0257"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-13T19:17:01Z",
"severity": "MODERATE"
},
"details": "Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS\u00ae software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.",
"id": "GHSA-jqxw-84hx-6qj5",
"modified": "2026-06-09T12:32:01Z",
"published": "2026-05-13T21:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0257"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-967325.html"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2026-0257"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-P84Q-CH5J-7FRH
Vulnerability from github – Published: 2025-04-17 18:31 – Updated: 2025-04-17 21:31An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.
{
"affected": [],
"aliases": [
"CVE-2024-55211"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T18:15:47Z",
"severity": "HIGH"
},
"details": "An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.",
"id": "GHSA-p84q-ch5j-7frh",
"modified": "2025-04-17T21:31:04Z",
"published": "2025-04-17T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55211"
},
{
"type": "WEB",
"url": "https://github.com/micaelmaciel/CVE-2024-55211"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PJM7-RWQQ-CWM2
Vulnerability from github – Published: 2022-05-13 01:52 – Updated: 2022-05-13 01:52PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_head.php, pc_login.php, and pc_login_page.php.
{
"affected": [],
"aliases": [
"CVE-2018-5190"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-17T13:29:00Z",
"severity": "CRITICAL"
},
"details": "PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_head.php, pc_login.php, and pc_login_page.php.",
"id": "GHSA-pjm7-rwqq-cwm2",
"modified": "2022-05-13T01:52:44Z",
"published": "2022-05-13T01:52:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5190"
},
{
"type": "WEB",
"url": "https://brianmccarthytech.blogspot.co.nz/2018/04/cve-2018-5190.html"
},
{
"type": "WEB",
"url": "https://www.picturespro.com/support-forum/photo-cart/?t=38346-security-patch-for-photo-cart-2018"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RC4Q-9M69-GQP8
Vulnerability from github – Published: 2021-05-17 20:53 – Updated: 2021-05-17 20:29Impact
Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service.
Patches
Version 3.1.0 of the fastify-csrf fixes it. See https://github.com/fastify/fastify-csrf/pull/51 and https://github.com/fastify/csrf/pull/2.
The user of the module would need to supply a userInfo when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
Workarounds
None available.
References
- https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
- https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf
Credits
This vulnerability was found by Xhelal Likaj xhelallikaj20@gmail.com.
For more information
If you have any questions or comments about this advisory: * Open an issue in fastify-csrf * Email us at hello@matteocollina.com
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fastify-csrf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-29624"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-565"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-17T20:29:48Z",
"nvd_published_at": "2021-05-19T22:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nUsers that used fastify-csrf with the \"double submit\" mechanism using cookies with an application deployed across multiple subdomains, e.g. \"heroku\"-style platform as a service. \n\n### Patches\n\nVersion 3.1.0 of the fastify-csrf fixes it. \nSee https://github.com/fastify/fastify-csrf/pull/51 and https://github.com/fastify/csrf/pull/2.\n\nThe user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.\n\n### Workarounds\n\nNone available.\n\n### References\n\n1. https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html\n2. https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf\n\n### Credits\n\nThis vulnerability was found by Xhelal Likaj \u003cxhelallikaj20@gmail.com\u003e.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [fastify-csrf](https://github.com/fastify/fastify-csrf)\n* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)\n",
"id": "GHSA-rc4q-9m69-gqp8",
"modified": "2021-05-17T20:29:48Z",
"published": "2021-05-17T20:53:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29624"
},
{
"type": "WEB",
"url": "https://github.com/fastify/csrf/pull/2"
},
{
"type": "WEB",
"url": "https://github.com/fastify/fastify-csrf/pull/51"
},
{
"type": "WEB",
"url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"
},
{
"type": "WEB",
"url": "https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0"
},
{
"type": "WEB",
"url": "https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Lack of protection against cookie tossing attacks in fastify-csrf"
}
GHSA-RP6H-H28Q-45MQ
Vulnerability from github – Published: 2022-05-13 01:51 – Updated: 2022-05-13 01:51EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.
{
"affected": [],
"aliases": [
"CVE-2018-20512"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-03T19:29:00Z",
"severity": "CRITICAL"
},
"details": "EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.",
"id": "GHSA-rp6h-h28q-45mq",
"modified": "2022-05-13T01:51:04Z",
"published": "2022-05-13T01:51:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20512"
},
{
"type": "WEB",
"url": "https://www.reddit.com/r/networking/comments/abu4kq/vulnerability_in_cdata_technologies_epon_cpewifi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RWW7-MM5M-VX73
Vulnerability from github – Published: 2023-06-30 06:30 – Updated: 2024-04-04 05:18Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
{
"affected": [],
"aliases": [
"CVE-2023-32612"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-30T05:15:09Z",
"severity": "HIGH"
},
"details": "Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.",
"id": "GHSA-rww7-mm5m-vx73",
"modified": "2024-04-04T05:18:42Z",
"published": "2023-06-30T06:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32612"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN78634340"
},
{
"type": "WEB",
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V2F2-VWC6-37GC
Vulnerability from github – Published: 2022-08-13 00:00 – Updated: 2022-08-16 00:00Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2022-2615"
],
"database_specific": {
"cwe_ids": [
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-12T20:15:00Z",
"severity": "MODERATE"
},
"details": "Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.",
"id": "GHSA-v2f2-vwc6-37gc",
"modified": "2022-08-16T00:00:23Z",
"published": "2022-08-13T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2615"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1268580"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-35"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VMHR-5QXJ-XVCM
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-10-26 12:00Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.
{
"affected": [],
"aliases": [
"CVE-2021-33842"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-565"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T12:15:00Z",
"severity": "HIGH"
},
"details": "Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.",
"id": "GHSA-vmhr-5qxj-xvcm",
"modified": "2022-10-26T12:00:32Z",
"published": "2022-05-24T19:04:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33842"
},
{
"type": "WEB",
"url": "https://www.incibe-cert.es/en/early-warning/ics-advisories/circutor-sge-plc1000-improper-authentication"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/circutor-sge-plc1000-improper-authentication"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Avoid using cookie data for a security-related decision.
Mitigation
Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
Mitigation
Add integrity checks to detect tampering.
Mitigation
Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
CAPEC-226: Session Credential Falsification through Manipulation
An attacker manipulates an existing credential in order to gain access to a target application. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. An attacker may be able to manipulate a credential sniffed from an existing connection in order to gain access to a target server.
CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.
CAPEC-39: Manipulating Opaque Client-based Data Tokens
In circumstances where an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) that data can be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker. In this pattern an attacker undermines the assumption that client side tokens have been adequately protected from tampering through use of encryption or obfuscation.