GHSA-xjp4-6w75-qrj7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xjp4-6w75-qrj7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-xjp4-6w75-qrj7/GHSA-xjp4-6w75-qrj7.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-xjp4-6w75-qrj7
- Aliases
- Published
- 2022-03-01T21:44:13Z
- Modified
- 2024-01-24T11:00:51.835475Z
- Severity
-
- 9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H CVSS Calculator
- Summary
- Remote CLI Command Execution Vulnerability in CodeIgniter4
- Details
-
Impact
This vulnerability allows attackers to execute CLI routes via HTTP request.
Patches
Upgrade to v4.1.9 or later.
Workarounds
None.
For more information
If you have any questions or comments about this advisory: * Open an issue in codeigniter4/CodeIgniter4 * Email us at SECURITY.md
- Database specific
{ "nvd_published_at": "2022-02-28T16:15:00Z", "cwe_ids": [ "CWE-20", "CWE-94" ], "severity": "CRITICAL", "github_reviewed_at": "2022-03-01T21:44:13Z", "github_reviewed": true }- References
-
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7
- https://nvd.nist.gov/vuln/detail/CVE-2022-24711
- https://github.com/codeigniter4/CodeIgniter4/commit/202f41ad522ba1d414b9d9c35aba1cb0c156b781
- https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-24711.yaml
- https://github.com/codeigniter4/CodeIgniter4
Affected packages
Packagist / codeigniter4/framework
Package
- Name
- codeigniter4/framework
- Purl
- pkg:composer/codeigniter4/framework