Cross-site Scripting Vulnerability in CodeIgniter4
Impact
Cross-Site Scripting (XSS) vulnerability was found in API\ResponseTrait in Codeigniter4. Attackers can do XSS attacks if you are using API\ResponseTrait.
Source excerpt · OSVWhat to do
Disable Auto Route and Use Defined Routes Only
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in codeigniter4/CodeIgniter4
- Email us at SECURITY.md
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 4.1.8Ecosystem versions | 4.1.8 |
Version evidence: OSV · GHSA-7528-7jg5-6g62
View original version evidence (26 explicit versions)
Original source description
Impact
Cross-Site Scripting (XSS) vulnerability was found in API\ResponseTrait in Codeigniter4.
Attackers can do XSS attacks if you are using API\ResponseTrait.
Patches
Upgrade to v4.1.8 or later.
Workarounds
Do one of the following:
- Do not use
API\ResponseTraitnorResourceController - Disable Auto Route and Use Defined Routes Only
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in codeigniter4/CodeIgniter4
- Email us at SECURITY.md
References
- Security advisory github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62
- Security advisory nvd.nist.gov/vuln/detail/CVE-2022-21715
- Patch github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd
- Source reference codeigniter4.github.io/userguide/incoming/routing.html
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21715.yaml
- Source reference github.com/codeigniter4/framework