CVE-2022-21715

MEDIUM

Cross-site Scripting Vulnerability in CodeIgniter4

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-21715 has a selected CVSS score of 5.4 (medium).

Description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

CodeIgniter4

Browse codeigniter4 / CodeIgniter4
CVE List< 4.1.8affected

codeigniter4/framework

Browse Packagist / codeigniter4/framework
GitHub AdvisoryBefore 4.1.8 · Fixed in 4.1.8affected

References

6