GitHub Advisoryadvisory · Packagist

GHSA-xjp4-6w75-qrj7 Remote CLI Command Execution Vulnerability in CodeIgniter4

CRITICAL Published 2022-03-01 Modified 2022-03-01 Official page ↗
Aliases
CVE-2022-24711
Ecosystem
Packagist
Packages
codeigniter4/framework
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weaknesses
CWE-20, CWE-94
Reviewed
2022-03-01

Affected packages

• Packagist codeigniter4/framework: < 4.1.9 → fixed in 4.1.9

Description

Impact This vulnerability allows attackers to execute CLI routes via HTTP request. Patches Upgrade to v4.1.9 or later. Workarounds None. For more information If you have any questions or comments about this advisory: • Open an issue in codeigniter4/CodeIgniter4 • Email us at SECURITY.md

Related

Alias · CVE (1)

  • CVE-2022-24711 CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References