icon

We found results for “

CVE-2022-21715

Date: January 24, 2022

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in "API\ResponseTrait" in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using "API\ResponseTrait". Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using "API\ResponseTrait" or "ResourceController" Users may also disable Auto Route and use defined routes only.

Language: PHP

Severity Score

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us