Medium severity · published Oct 6, 2022
CVE-2022-39284
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
4.3
CVSS
1.1%
EPSS
No
On KEV
Description
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CodeIgniter4 · codeigniter4
< 4.2.7 · source: vendor
CO
Codeigniter · Codeigniter
4.0.0 before 4.2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39284
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39284
Technical Description
https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie
Technical Description
https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie
Technical Description
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
Exploit
https://github.com/codeigniter4/CodeIgniter4/issues/6540
Patch
https://github.com/codeigniter4/CodeIgniter4/pull/6544
Mitigation
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp
More from CodeIgniter4
9.8
CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
9.8
CVE-2026-48062
CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
9.8
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
9.4
CVE-2026-63221
CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
7.5
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames