CVE-2022-46170

描述

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

如何修補 CVE-2022-46170

要修補 CVE-2022-46170,請將受影響套件升級到下列已修補版本。

• —升級至 4.2.11 或更新版本
• —升級至 4.2.11 或更新版本

CVE-2022-46170 正在被利用嗎?

低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 4.0.0, < 4.2.11
• from 0, < 4.2.11

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-46170
• PATCHgithub.com/codeigniter4/CodeIgniter4
• WEBcodeigniter4.github.io/userguide/libraries/sessions.html#session-drivers
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-46170.yaml