-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| illuminate/cookie | composer | >= 4.1.0, < 6.18.31 | 6.18.31 |
| illuminate/cookie | composer | >= 7.0.0, < 7.22.4 | 7.22.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing HMAC-based validation during cookie encryption/decryption. The pre-patch implementation in EncryptCookies middleware allowed arbitrary encrypted values to be accepted as valid cookies if an encryption oracle existed. The functions responsible for raw encryption/decryption (without HMAC context) are the core vulnerability points, as they enabled cookie forgery. The fix introduced HMAC prefixing in these methods, confirming their central role in the vulnerability.
Ongoing coverage of React2Shell