CVE-2022-39284 json
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
published 2022-10-06 4 y ago modified 2026-06-17 4 mo ago also BIT-codeigniter-2022-39284 , EUVD-2022-7041 , GHSA-745p-r637-7vvp
- cvss
- 2.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.
Patch / fix
- packagist codeigniter4/framework 4.2.7
- bitnami codeigniter 4.2.7
- codeigniter codeigniter 4.2.7
- github.com/codeigniter4/CodeIgniter4#6544 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/codeigniter4/CodeIgniter4/issues/6540 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | codeigniter4/framework | <4.2.7 |
4.2.7 |
| bitnami | codeigniter | >=4.0.0, <4.2.7 |
4.2.7 |
Affected products
- codeigniter4 CodeIgniter4
Classification
References
-
github.com
/codeigniter4/CodeIgniter4/pull/6544
web, patch, third-party-advisory
-
github.com
/codeigniter4/CodeIgniter4/issues/6540
web, exploit, issue-tracking, third-party-advisory
-
github.com
/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp
web, mitigation, third-party-advisory
-
codeigniter4.github.io
/userguide/helpers/cookie_helper.html#set_cookie
web, technical-description, third-party-advisory
-
codeigniter4.github.io
/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie
web, technical-description, third-party-advisory
-
developer.mozilla.org
/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
web, technical-description, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-39284
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-39284.yaml
web
-
github.com
/codeigniter4/CodeIgniter4
package
Sources
- CVE List CVE-2022-39284
- GitHub Advisory GHSA-745p-r637-7vvp
- NVD CVE-2022-39284
- OSV BIT-codeigniter-2022-39284
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.