Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting the authentication information from a cookie.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2001-0001 | A cookie is not proof of identity Imagine a visitor badge that reveals how to impersonate someone else. In PHP-Nuke 4.4, a cookie-decoding flaw let users bypass authentication and access other accounts. Identity checks need more than readable data.
Browser cookies can carry login state. The bug was in PHP-Nuke's cookiedecode function, not in every cookie or browser. Lesson: validate authentication on the server and protect session secrets. Official record: https://github.com/CVEProject/cvelistV5/blob/main/cves/2001/0xxx/CVE-2001-0001.json
CVE-2001-0001, visualized: a visitor pass is only useful if the identity check behind it is sound. In PHP-Nuke 4.4, the cookiedecode function allowed authentication to be bypassed using authentication information extracted from a cookie, exposing other user accounts. This is a historical application flaw, not a claim that cookies are inherently unsafe. Source: https://www.cve.org/CVERecord?id=CVE-2001-0001
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | francisco_burzi | php-nuke | 4.4 | - | - |