CVE-2022-46170

2022-12-2219:15:09

CWE-287

GitHub_M

web.nvd.nist.gov

codeigniter

php

framework

session cookies

unauthorized access

security vulnerability

cve-2022-46170

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

59.8%

JSON

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Affected configurations

Nvd

Vulners

Node

codeignitercodeigniterRange4.0.0–4.2.11

VendorProductVersionCPE
codeignitercodeigniter*cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
codeigniter	codeigniter	*	cpe:2.3:a:codeigniter:codeigniter::::::::

CNA Affected

[
  {
    "vendor": "codeigniter4",
    "product": "CodeIgniter4",
    "versions": [
      {
        "version": "< 4.2.11",
        "status": "affected"
      }
    ]
  }
]