Improper Initialization in CodeIgniter4 - CVE-2022-39284
Published: October 6, 2022 / Updated: May 23, 2026
Vulnerability identifier: #VU132165
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-39284
CWE-ID: CWE-665
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass intended cookie security restrictions.
The vulnerability exists due to improper initialization in set_cookie() and Response::setCookie() when issuing cookies based on Config\Cookie settings. A remote attacker can cause cookies to be issued without the secure or HttpOnly flag to bypass intended cookie security restrictions.
Session cookies are not affected.
Affected software
CodeIgniter4
How to mitigate CVE-2022-39284
Install security update from vendor's website.
CodeIgniter4 - update to 4.2.7