CodeIgniter4 Potential Session Handlers Vulnerability

NGHIÊM TRỌNG 9.8CVE-2022-46170 · BIT-codeigniter-2022-46170 · GHSA-6cq5-8cj7-g558 · Công bố 22/12/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-46170 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng codeigniter4/framework, codeigniter (codeigniter).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.91%, cao hơn 60.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.2.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
codeigniter4/framework Packagist	`< 4.2.11`	`4.2.11`
codeigniter codeigniter	`≥ 4.0.0, < 4.2.11`	`4.2.11`

Mô tả

Impact

When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages).

Patches

Upgrade to version 4.2.11 or later.

Workarounds

Use only one session cookie.

References

https://codeigniter4.github.io/userguide/libraries/sessions.html#session-drivers

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

Mô tả của NVD

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.