Vulnerabilities > CVE-2022-46170 - Unspecified vulnerability in Codeigniter

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

codeigniter

critical

NVD

Published: 2022-12-22

Updated: 2024-11-21

Summary

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Vulnerable Configurations

Part	Description	Count
Application	Codeigniter Codeigniter Codeigniter 4.0.0 Codeigniter Codeigniter 4.0.1 Codeigniter Codeigniter 4.0.2 Codeigniter Codeigniter 4.0.3 Codeigniter Codeigniter 4.0.4 Codeigniter Codeigniter 4.0.5 Codeigniter Codeigniter 4.1.0 Codeigniter Codeigniter 4.1.1 Codeigniter Codeigniter 4.1.2 Codeigniter Codeigniter 4.1.3 Codeigniter Codeigniter 4.1.4 Codeigniter Codeigniter 4.1.5 Codeigniter Codeigniter 4.1.6 Codeigniter Codeigniter 4.1.7 Codeigniter Codeigniter 4.1.8 Codeigniter Codeigniter 4.1.9 Codeigniter Codeigniter 4.2.0 Codeigniter Codeigniter 4.2.1 Codeigniter Codeigniter 4.2.2 Codeigniter Codeigniter 4.2.3 Codeigniter Codeigniter 4.2.4 Codeigniter Codeigniter 4.2.5 Codeigniter Codeigniter 4.2.6 Codeigniter Codeigniter 4.2.7 Codeigniter Codeigniter 4.2.8 Codeigniter Codeigniter 4.2.9 Codeigniter Codeigniter 4.2.10	40

Summary

Vulnerable Configurations

References