CVE-2022-46170CWE-287

CodeIgniter is vulnerable to improper authentication via Session Handlers

High · published December 22, 2022

CVSS v3.1
8.6
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00912 · 59.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-12-22T18:58Z
EPSS history
Timeline
  • 22 DEC 18:58Z
    CodeIgniter is vulnerable to improper authentication via Session Handlers
    cvelistv5