PT-2024-40426 · Unknown · Codeigniter

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter/Framework versions prior to 3.0.3

Description The issue concerns the xss clean() method in the Security Library, which is intended to sanitize input data and prevent Cross-Site Scripting (XSS) attacks. However, in affected versions, the method failed to adequately mitigate specific XSS vectors, leaving a potential security gap.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider disabling the xss clean() method until a patch is available, and instead, implement alternative input sanitization mechanisms to minimize the risk of XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-Q9J3-4GHJ-6H57

Affected Products

Codeigniter

References · 5

• https://osv.dev/vulnerability/GHSA-q9j3-4ghj-6h57 · Vendor Advisory
• https://github.com/bcit-ci/CodeIgniter · Note
• https://github.com/bcit-ci/CodeIgniter/commit/71b1b3f5b2dcc0f4b652e9494e9853b82541ac8c · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter/framework/2015-10-31-1.yaml · Note
• https://codeigniter.com/user_guide/changelog.html#version-3-0-3 · Note