Detections
Analytics

SCA: security update for react/http (GHSA-w3w9-vrf5-8mx8)

medium Tenable Cloud Security Plugin ID 419670

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server
 component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP
 cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and
 `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to
 forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a
 workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to
 filter out any unexpected `Cookie` request headers. (CVE-2022-36032)

See Also

https://github.com/advisories/GHSA-w3w9-vrf5-8mx8

Plugin Details

Severity: Medium

ID: 419670

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2022-36032

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/16/2022

Vulnerability Publication Date: 9/6/2022

Reference Information

CVE: CVE-2022-36032