Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03NTI4LTdqZzUtNmc2Ms0l_g

Cross-site Scripting Vulnerability in CodeIgniter4

Impact

Cross-Site Scripting (XSS) vulnerability was found in API\ResponseTrait in Codeigniter4.
Attackers can do XSS attacks if you are using API\ResponseTrait.

Patches

Upgrade to v4.1.8 or later.

Workarounds

Do one of the following:

1. Do not use API\ResponseTrait nor ResourceController
2. Disable Auto Route and Use Defined Routes Only

References

• Cross Site Scripting (XSS) Software Attack | OWASP Foundation

For more information

If you have any questions or comments about this advisory:

• Open an issue in codeigniter4/CodeIgniter4
• Email us at SECURITY.md

Permalink: https://github.com/advisories/GHSA-7528-7jg5-6g62
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NTI4LTdqZzUtNmc2Ms0l_g
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 3 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Identifiers: GHSA-7528-7jg5-6g62, CVE-2022-21715
References:

• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62
• https://nvd.nist.gov/vuln/detail/CVE-2022-21715
• https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd
• https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only
• https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21715.yaml
• https://github.com/advisories/GHSA-7528-7jg5-6g62

Repository: https://github.com/codeigniter4/CodeIgniter4
Blast Radius: 18.0

Affected Packages