PT-2022-27784 · Unknown · Codeigniter

Mgatner + 1 · Published 2022-12-22 · Updated 2024-03-06 · CVE-2022-46170

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.2.11

Description The issue arises when an application uses multiple session cookies and a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler. If an attacker obtains one session cookie, they may be able to access pages that require another session cookie.

Recommendations For versions prior to 4.2.11, upgrade to version 4.2.11 or later. As a temporary workaround, consider using only one session cookie until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-CODEIGNITER-2022-46170

CVE-2022-46170

GHSA-6CQ5-8CJ7-G558

Affected Products

Codeigniter

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46170.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-46170.yaml · Exploit
• https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-46170 · Security Note
• https://osv.dev/vulnerability/BIT-codeigniter-2022-46170 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6cq5-8cj7-g558 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46170 · Vendor Advisory
• https://github.com/codeigniter4/CodeIgniter4 · Note
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558 · Note
• https://codeigniter4.github.io/userguide/libraries/sessions.html#session-drivers · Note