« Volver al listado

CVE-2022-35943

Estado: ModificadaAlta (8.8)—

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**.

Leer descripción completaMostrar menos

As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Codeigniter — CodeigniterCodeigniter — Shield

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-35943",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-35943",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-22T15:45:07.423965Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "codeigniter4",
          "product": "shield",
          "versions": [
            {
              "status": "affected",
              "version": "> 4.3.2, > v1.0.0-beta.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-12T21:15:07.803",
  "references": [
    {
      "url": "https://codeigniter4.github.io/userguide/libraries/security.htm",
      "tags": [
        "Broken Link"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jub0bs.com/posts/2021-01-29-great-samesite-confusion",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://codeigniter4.github.io/userguide/libraries/security.htm",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jub0bs.com/posts/2021-01-29-great-samesite-confusion",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)"
    },
    {
      "lang": "es",
      "value": "Shield es un marco de autenticación y autorización para CodeIgniter 4. Esta vulnerabilidad puede permitir a [Atacantes del Mismo Sitio](https://canitakeyoursubdomain.name/) omitir el mecanismo de [protección CSRF de CodeIgniter4](https://codeigniter4.github.io/userguide/libraries/security.html) con CodeIgniter Shield. Para que este ataque tenga éxito, el atacante debe tener control directo (o indirecto, por ejemplo, de tipo XSS) sobre un sitio subdominio (por ejemplo, \"https://a.example.com/\") del sitio objetivo (por ejemplo, \"http://example.com/\"). Actualice a **CodeIgniter versiones v4.2.3 o posteriores** y **Shield versiones v1.0.0-beta.2 o posteriores**. Como mitigación: establezca \"Config\\Security::$csrfProtection\" como \"\"sesión,\"\"elimine los datos de la sesión antigua justo después del inicio de sesión (inmediatamente después de que el ID y la contraseña coincidan) y regenere el token CSRF justo después del inicio de sesión (inmediatamente después de que el ID y la contraseña coincidan)"
    }
  ],
  "lastModified": "2026-06-17T04:52:34.443",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBF0023B-014D-4BB0-A3C9-9A73D58C0C15",
              "versionEndExcluding": "4.2.3"
            },
            {
              "criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1E3F1E0-C2D7-4EC5-AD04-AEB414A3D71C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}