GitHub Advisoryadvisory · Packagist

GHSA-7528-7jg5-6g62 Cross-site Scripting Vulnerability in CodeIgniter4

MEDIUM Published 2022-01-27 Modified 2022-01-31 Official page ↗
Aliases
CVE-2022-21715
Ecosystem
Packagist
Packages
codeigniter4/framework
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-01-24

Affected packages

• Packagist codeigniter4/framework: < 4.1.8 → fixed in 4.1.8

Description

Impact Cross-Site Scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4. Attackers can do XSS attacks if you are using `API\ResponseTrait`. Patches Upgrade to v4.1.8 or later. Workarounds Do one of the following: 1. Do not use `API\ResponseTrait` nor `ResourceController` 2. Disable Auto Route and Use Defined Routes Only References • Cross Site Scripting (XSS) Software Attack | OWASP Foundation For more information If you have any questions or comments about this advisory: • Open an issue in codeigniter4/CodeIgniter4 • Email us at SECURITY.md

Related

Alias · CVE (1)

  • CVE-2022-21715 CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References