Cross-Site Scripting Vulnerability in CodeIgniter4 Framework
Summary
GHSA-49jm-g4m8-x53p: Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter. Affects codeigniter4/framework versions < 4.6.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter4 is a powerful PHP framework designed for building web applications. It offers a rich set of features, including a robust routing system, built-in security measures, and a flexible architecture. However, like any software, it can be susceptible to vulnerabilities, such as cross-site scripting (XSS), which can compromise the security of applications built using this framework.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability was identified in CodeIgniter4 version 4.6.0. This vulnerability allows attackers to inject arbitrary web scripts or HTML into the application via the 'debugbar_time' parameter. If exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or the execution of malicious scripts in the context of the user's session.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As no specific workaround is provided due to the withdrawal of the advisory, it is advisable to ensure that user input is properly sanitized and validated to mitigate potential XSS attacks. Implementing Content Security Policy (CSP) headers can also help reduce the risk of XSS.
Conclusion
In summary, while a cross-site scripting vulnerability was reported in CodeIgniter4, the advisory has since been withdrawn due to its invalidity. Users are encouraged to keep their frameworks updated and to implement security best practices to safeguard their applications.
See every vulnerability recorded for codeigniter4/framework →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate level of risk.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor open-source vulnerabilities without requiring installation.
If immediate updates are not possible, ensure that all user inputs are sanitized and consider implementing CSP headers to mitigate the risk of XSS attacks.
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
The advisory was withdrawn because the original report was found to be invalid, indicating that the vulnerability may not exist as initially reported.
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
