CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10793
https://notcve.org/view.php?id=CVE-2020-10793
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself. CodeIgniter hasta la versión 4.0.0 permite a los atacantes remotos obtener privilegios a través de un ID de correo electrónico modificado a la página "Seleccionar el rol del usuario". • https://codeigniter4.github.io/userguide/extending/authentication.html https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeigniter-framework-ca30741ad297 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-12071
https://notcve.org/view.php?id=CVE-2018-12071
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled. Existe un problema de fijación de sesión en CodeIgniter en versiones anteriores a la 3.1.9 debido a que session.use_strict_mode se gestionó de manera incorrecta en Session Library. • https://www.codeigniter.com/user_guide/changelog.html • CWE-384: Session Fixation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000247
https://notcve.org/view.php?id=CVE-2017-1000247
British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws. British Columbia Institute of Technology CodeIgniter 3.1.3 es vulnerable a la inyección de cabeceras HTTP en la función común set_status_header() en Apache, provocando errores de inyección de cabeceras HTTP. • https://www.codeigniter.com/userguide3/changelog.html#version-3-1-4 • CWE-20: Improper Input Validation •