Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2022-46170 Details

Description

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328 CVEPatchThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558 CVEThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328 [email protected]PatchThird Party Advisory
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558 [email protected]Third Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-287Improper Authentication[email protected]

Affected Products

ProductVersions
codeigniter codeigniter
>= 4.0.0, < 4.2.11

CPE

  • cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2022-46170
NVD Published Date:
Dec 22, 2022
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2022-46170 Details - Not Deferred