{"id":"CVE-2022-23556","published":"2022-12-22T18:50:55Z","modified":"2025-04-15T14:37:02Z","title":"CodeIgniter is vulnerable to IP address spoofing when using proxy","vendor":"codeigniter4","product":"CodeIgniter4","tier":"tail","description":{"text":"CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00398,"percentile":0.34052,"provenance":"source"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"references":[{"url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-ghw3-5qvm-3mqc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/commit/5ca8c99b2db09a2a08a013836628028ddc984659","tags":["x_refsource_MISC"]}],"priority":{"score":11.7,"factors":[{"name":"EPSS percentile","points":6.81},{"name":"CVSS severity","points":4.9}]},"vendorSlug":"codeigniter4","affectedVersions":[{"vendor":"codeigniter4","product":"CodeIgniter4","versions":["< 4.2.11"]}],"affected":[{"ecosystem":"Packagist","package":"codeigniter4/framework","vulnerableRanges":["<4.2.11"],"patched":["4.2.11"],"from":["GHSA-ghw3-5qvm-3mqc"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7632","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-24711","published":"2022-02-28","fixed":"4.1.9","kev":false},{"cve":"CVE-2022-24712","published":"2022-02-28","fixed":"4.1.9","kev":false},{"cve":"CVE-2022-39284","published":"2022-10-06","fixed":"4.2.7","kev":false,"link":{"from":"CVE-2022-39284","to":"CVE-2022-23556","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:codeigniter4/framework","fromFixed":"4.2.7","toFixed":"4.2.11","daysApart":77}]}},{"cve":"CVE-2022-23556","published":"2022-12-22","fixed":"4.2.11","kev":false},{"cve":"CVE-2022-46170","published":"2022-12-22","fixed":"4.2.11","kev":false},{"cve":"CVE-2023-32692","published":"2023-05-30","fixed":"4.3.5","kev":false},{"cve":"CVE-2023-46240","published":"2023-10-31","fixed":"4.4.3","kev":false}],"package":"Packagist:codeigniter4/framework"}}