Fluid Attacks Database

Description

Cross-site Scripting Vulnerability in CodeIgniter4

Impact

Cross-Site Scripting (XSS) vulnerability was found in API\ResponseTrait in Codeigniter4. Attackers can do XSS attacks if you are using API\ResponseTrait.

Patches

Upgrade to v4.1.8 or later.

Workarounds

Do one of the following:

Do not use API\ResponseTrait nor ResourceController

Disable Auto Route and Use Defined Routes Only

References

Cross Site Scripting (XSS) Software Attack | OWASP Foundation

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4

Email us at SECURITY.md

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	codeigniter4/framework	>=0 <4.1.8	4.1.8

Aliases

1. CVE-2022-217152. NVD-2022-217153. OSV-2022-217154. GHSA-7528-7jg5-6g625. GCVE-2022-21715

References

1. https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g622. https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd3. https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only4. https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21715.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.