{"id":"CVE-2022-21715","published":"2022-01-24T19:55:10Z","modified":"2025-04-23T19:09:30Z","title":"Cross-site Scripting Vulnerability in CodeIgniter4","vendor":"codeigniter4","product":"CodeIgniter4","tier":"tail","description":{"text":"CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01002,"percentile":0.62863,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd","tags":["x_refsource_MISC"]},{"url":"https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only","tags":["x_refsource_MISC"]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":12.57},{"name":"CVSS severity","points":3.78}]},"vendorSlug":"codeigniter4","affectedVersions":[{"vendor":"codeigniter4","product":"CodeIgniter4","versions":["< 4.1.8"]}],"affected":[{"ecosystem":"Packagist","package":"codeigniter4/framework","vulnerableRanges":["<4.1.8"],"patched":["4.1.8"],"from":["GHSA-7528-7jg5-6g62"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0495","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-codeigniter4-cve-2022-21715","children":[{"from":"CVE-2022-21715","to":"CVE-2022-24711","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:codeigniter4/framework","fromFixed":"4.1.8","toFixed":"4.1.9","daysApart":35},{"kind":"same-code","provenance":"machine","files":["system/CodeIgniter.php","user_guide_src/source/conf.py"],"commits":["https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd","https://github.com/codeigniter4/CodeIgniter4/commit/202f41ad522ba1d414b9d9c35aba1cb0c156b781"],"basis":"shared function","functions":["CodeIgniter"]}]},{"from":"CVE-2022-21715","to":"CVE-2024-29904","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["system/CodeIgniter.php"],"commits":["https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd","https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2017-1000247","published":"2017-11-17","fixed":"3.1.4","kev":false},{"cve":"CVE-2022-21647","published":"2022-01-04","fixed":"4.1.6","kev":false,"link":{"from":"CVE-2022-21647","to":"CVE-2022-21715","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:codeigniter4/framework","fromFixed":"4.1.6","toFixed":"4.1.8","daysApart":20}]}},{"cve":"CVE-2022-21715","published":"2022-01-24","fixed":"4.1.8","kev":false},{"cve":"CVE-2022-24711","published":"2022-02-28","fixed":"4.1.9","kev":false},{"cve":"CVE-2022-24712","published":"2022-02-28","fixed":"4.1.9","kev":false,"link":{"from":"CVE-2022-21715","to":"CVE-2022-24712","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:codeigniter4/framework","fromFixed":"4.1.8","toFixed":"4.1.9","daysApart":35}]}},{"cve":"CVE-2022-39284","published":"2022-10-06","fixed":"4.2.7","kev":false}],"package":"Packagist:codeigniter4/framework"}}