CVE-2022-21715CWE-79

Cross-site Scripting Vulnerability in CodeIgniter4

Medium · published January 24, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
62.5
In the wild
Unconfirmed
What it is

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01002 · 62.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-01-24T19:55Z
EPSS history
Timeline
  • 24 JAN 19:55Z
    Cross-site Scripting Vulnerability in CodeIgniter4
    cvelistv5