CVE-2022-21715

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
codeigniter4	CodeIgniter4	< 4.1.8

References

https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-onlyMitigation, Vendor Advisory
https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8ddPatch, Third Party Advisory
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62Mitigation, Third Party Advisory
https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-onlyMitigation, Vendor Advisory
https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8ddPatch, Third Party Advisory
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62Mitigation, Third Party Advisory

Timeline

Published: Jan 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-217167.5Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implem CVE-2022-217185.0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to CVE-2022-217196.1GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. CVE-2022-21724.3The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change se CVE-2022-217204.9GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally i CVE-2022-217217.5Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a CVE-2022-217229.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217239.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217249.8pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security rese CVE-2022-217256.5Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a CVE-2022-217268.8Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and CVE-2022-217278.8Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer