4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
32.1%
Setting $secure
or $httponly
value to true
in Config\Cookie
is not reflected in set_cookie()
or Response::setCookie()
.
> Note
> This vulnerability does not affect session cookies.
The following code does not issue a cookie with the secure flag even if you set $secure = true
in Config\Cookie
.
helper('cookie');
$cookie = [
'name' => $name,
'value' => $value,
];
set_cookie($cookie);
// or
$this->response->setCookie($cookie);
Upgrade to v4.2.7 or later.
helper('cookie');
$cookie = [
'name' => $name,
'value' => $value,
'secure' => true,
'httponly' => true,
];
set_cookie($cookie);
// or
$this->response->setCookie($cookie);
use CodeIgniter\Cookie\Cookie;
helper('cookie');
$cookie = new Cookie($name, $value);
set_cookie($cookie);
// or
$this->response->setCookie($cookie);
If you have any questions or comments about this advisory:
codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie
codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie
developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
github.com/codeigniter4/CodeIgniter4
github.com/codeigniter4/CodeIgniter4/issues/6540
github.com/codeigniter4/CodeIgniter4/pull/6544
github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp
github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-39284.yaml
nvd.nist.gov/vuln/detail/CVE-2022-39284