CodeIgniter4 Potential Session Handlers Vulnerability

緊急 9.8CVE-2022-46170 · BIT-codeigniter-2022-46170 · GHSA-6cq5-8cj7-g558 · 22/12/2022 公開 · 17/06/2026 更新

要点

CVE-2022-46170 は codeigniter4/framework, codeigniter (codeigniter) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.91%（全脆弱性の 60.1% より高い）。
対処：4.2.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
codeigniter4/framework Packagist	`< 4.2.11`	`4.2.11`
codeigniter codeigniter	`≥ 4.0.0, < 4.2.11`	`4.2.11`

概要

Impact

When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages).

Patches

Upgrade to version 4.2.11 or later.

Workarounds

Use only one session cookie.

References

https://codeigniter4.github.io/userguide/libraries/sessions.html#session-drivers

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD の説明

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.