Login Request a demo
Critical severity · published Dec 22, 2022
CVE-2022-46170
CodeIgniter is a PHP full-stack web framework
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Codeigniter · Codeigniter
4.0.0 before 4.2.11 · source: NVD
Affected product
CO
Codeigniter
Codeigniter
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-46170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-46170
Patch
https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328
Third Party Advisory
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558
More from Codeigniter
9.8
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
9.8
CVE-2023-32692
CodeIgniter is a PHP full-stack web framework
9.8
CVE-2022-40834
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have…
9.8
CVE-2022-40824
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have…
9.8
CVE-2022-40825
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have…