Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
Vulnerability Description
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Vulnerability Type
初始化不恰当
Vulnerability Title
CodeIgniter 安全漏洞
Vulnerability Description
CodeIgniter是一款使用PHP语言编写的开源Web框架。 CodeIgniter 4.2.7之前的版本存在安全漏洞，该漏洞源于其不正确的配置导致cookie值被错误地公开给脚本。
CVSS Information
N/A
Vulnerability Type
N/A