CVE-2022-21715

Description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.

How to fix CVE-2022-21715

To remediate CVE-2022-21715, upgrade the affected package to a fixed version below.

• —upgrade to 4.1.8 or later
• —upgrade to 4.1.8 or later

Is CVE-2022-21715 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 4.0.0, < 4.1.8
• from 0, < 4.1.8

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-21715
• PATCHgithub.com/codeigniter4/framework
• WEBcodeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21715.yaml