CVE-2022-35943

Katalog CVE

CVSS 8.8 · High EPSS 0,59%

Kerentanan Cross-Site Request Forgery (CSRF) pada codeigniter, codeigniter shield. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)

Rincian

Terbit di NVD

12 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq exploit · mitigasi · advisory pihak ketiga
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite advisory pihak ketiga
• https://jub0bs.com/posts/2021-01-29-great-samesite-confusion advisory pihak ketiga
• https://codeigniter4.github.io/userguide/libraries/security.htm broken link