CVE-2022-46170

2022-12-2219:15:09

CWE-287

[email protected]

web.nvd.nist.gov

codeigniter

php

framework

session cookies

unauthorized access

security vulnerability

cve-2022-46170

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.9%

JSON

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Affected configurations

Vulners

NVD

Node

codeigniter4codeigniter4Range<4.2.11

CPENameOperatorVersion
codeigniter:codeignitercodeigniterlt4.2.11

CPE	Name	Operator	Version
codeigniter:codeigniter	codeigniter	lt	4.2.11

CNA Affected

[
  {
    "vendor": "codeigniter4",
    "product": "CodeIgniter4",
    "versions": [
      {
        "version": "< 4.2.11",
        "status": "affected"
      }
    ]
  }
]