← Vulnerability feed

Vulnerability record · CVE-2022-39284 · published 6 October 2022

CVE-2022-39284: Codeigniter incorrect permission assignment vulnerability

Codeigniter · Codeigniter

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.

4.3 CVSS 3.1 Medium EPSS 0.91% · top 41.6% CWE-665 · CWE-665CWE-732 · Incorrect permission assignment
4.3CVSS 3.1 base score
0.91%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie Technical DescriptionThird Party Advisory
https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie Technical DescriptionThird Party Advisory
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies Technical DescriptionThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/issues/6540 ExploitIssue TrackingThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/pull/6544 PatchThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp MitigationThird Party Advisory
https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie Technical DescriptionThird Party Advisory
https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie Technical DescriptionThird Party Advisory
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies Technical DescriptionThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/issues/6540 ExploitIssue TrackingThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/pull/6544 PatchThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp MitigationThird Party Advisory

Track CVE-2022-39284 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-54418Codeigniter os command injection vulnerabilityCodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the…EPSS 1.5%9.8CVE-2023-32692Codeigniter code injection vulnerabilityCodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. Th…EPSS 1.1%9.8CVE-2022-46170Codeigniter improper authentication vulnerabilityCodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin page…EPSS 0.84%9.8CVE-2022-40826Codeigniter sql injection vulnerabilityB.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note:…EPSS 0.96%9.8CVE-2022-40827Codeigniter sql injection vulnerabilityB.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Mul…EPSS 0.92%9.8CVE-2022-40828Codeigniter sql injection vulnerabilityB.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function.…EPSS 0.96%9.8CVE-2022-40829Codeigniter sql injection vulnerabilityB.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: M…EPSS 0.96%9.8CVE-2022-40830Codeigniter sql injection vulnerabilityB.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. No…EPSS 0.96%

Source: NIST National Vulnerability Database (record CVE-2022-39284), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.