CVE-2022-23556

2022-12-2219:15:09

Google

osv.dev

codeigniter

php

web framework

vulnerability

patched

reverse proxy

ip address

upgrade

version 4.2.11

config

app

proxyips

workaround

getipaddress

software

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

29.4%

JSON

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure Config\App::$proxyIPs. As a workaround, do not use $request->getIPAddress().

CPENameOperatorVersion
codeigniter4eq4.2.4
codeigniter4eq4.0.0-alpha.1
codeigniter4eq4.2.1
codeigniter4eq4.0.0-rc.2b
codeigniter4eq4.1.0
codeigniter4eq4.0.1
codeigniter4eq4.2.7
codeigniter4eq4.1.6
codeigniter4eq4.1.3
codeigniter4eq4.0.0-alpha.3

Name	Operator	Version
codeigniter4	eq	4.2.4
codeigniter4	eq	4.0.0-alpha.1
codeigniter4	eq	4.2.1
codeigniter4	eq	4.0.0-rc.2b
codeigniter4	eq	4.1.0
codeigniter4	eq	4.0.1
codeigniter4	eq	4.2.7
codeigniter4	eq	4.1.6
codeigniter4	eq	4.1.3
codeigniter4	eq	4.0.0-alpha.3