What’s Vulnerable › Vulnerabilities

CVE-2022-39284: Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-10-06 · updated 2026-06-17
• Weakness: CWE-665

Description

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.

Affected products

• CodeIgniter4: from 4.0.0 before 4.2.7 — fixed in 4.2.7

How to fix

Upgrade to a fixed version: CodeIgniter4 4.2.7. Check the vendor advisory for mitigations.

References

• https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie
• https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
• https://github.com/codeigniter4/CodeIgniter4/issues/6540
• https://github.com/codeigniter4/CodeIgniter4/pull/6544
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp
• https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie
• https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
• https://github.com/codeigniter4/CodeIgniter4/issues/6540
• https://github.com/codeigniter4/CodeIgniter4/pull/6544
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp

Get alerted when CVE-2022-39284 or the next vulnerability affects your stack