CVE-2022-23556
CVE-2022-23556 · CodeIgniter is vulnerable to IP address spoofing when using proxy
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.
CVSS 7.0 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
codeigniter4
- Versions
- < 4.2.11: Affected
No fix published
codeigniter4/framework Packagist
- Versions
- 4.0.0
- 4.0.0-rc.4
- v4.0.0-alpha.3
- v4.0.0-alpha.4
- v4.0.0-alpha.5
- v4.0.0-beta.1
- v4.0.0-beta.2
- v4.0.0-beta.3
- v4.0.0-beta.4
- v4.0.0-rc.1
- v4.0.0-rc.2
- v4.0.0-rc.2.1
- v4.0.0-rc.3
- v4.0.1
- v4.0.2
- v4.0.3
- v4.0.4
- v4.0.5
- v4.1.0
- v4.1.1
- v4.1.2
- v4.1.3
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.2.0
- v4.2.1
- v4.2.10
- v4.2.2
- v4.2.3
- v4.2.4
- v4.2.5
- v4.2.6
- v4.2.7
- v4.2.8
- v4.2.9
- Affected ranges
- ECOSYSTEM: < 4.2.11
Update to 4.2.11