CVE-2022-21715
MEDIUM5.4EPSS 0.37%Cross-site Scripting Vulnerability in CodeIgniter4
發布日:2022/1/27修改日:2024/3/6
描述
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.
受影響套件(2)
- Bitnami/codeigniter>= 4.0.0, < 4.1.8
- Packagist/codeigniter4/frameworkfrom 0, < 4.1.8
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
參考連結(6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-21715
- PATCHhttps://github.com/codeigniter4/framework
- WEBhttps://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only
- WEBhttps://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd
- WEBhttps://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62
- WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21715.yaml