{"id":"CVE-2022-39284","aliases":["BIT-codeigniter-2022-39284","EUVD-2022-7041","GHSA-745p-r637-7vvp"],"status":"published","title":"Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued in Codeigniter4","description":"CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01122,"percentile":0.66438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-665","CWE-732"],"published":"2022-10-06T00:00:00Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Packagist","package":"codeigniter4/framework","fixed_in":["4.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"codeigniter","fixed_in":["4.2.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"codeigniter4/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"codeigniter","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.2.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"codeigniter4/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7"}]}],"versions":["4.0.0","4.0.0-rc.4","v4.0.0-alpha.3","v4.0.0-alpha.4","v4.0.0-alpha.5","v4.0.0-beta.1","v4.0.0-beta.2","v4.0.0-beta.3","v4.0.0-beta.4","v4.0.0-rc.1","v4.0.0-rc.2","v4.0.0-rc.2.1","v4.0.0-rc.3","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6"]}],"products":[{"vendor":"codeigniter","product":"codeigniter"},{"vendor":"codeigniter4","product":"codeigniter4"}],"references":[{"url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp","tags":["x_transferred","Mitigation","Third Party Advisory","web","advisory"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/issues/6540","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/pull/6544","tags":["x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie","tags":["x_transferred","Technical Description","Third Party Advisory","web"]},{"url":"https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie","tags":["x_transferred","Technical Description","Third Party Advisory","web"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies","tags":["x_transferred","Technical Description","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39284","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-39284.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-745p-r637-7vvp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39284.json","tags":["advisory"]},{"url":"https://github.com/codeigniter4/CodeIgniter4","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-39284","title":"Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued in Codeigniter4","description":"CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.","status":"published","published":"2022-10-06T00:00:00Z","modified":"2025-04-22T17:19:34.229Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-7041","description":"CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.","status":"published","published":"2022-10-06T00:00:00Z","modified":"2025-04-22T17:19:34Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:52:16.055056Z"}],"ghsa":[{"id":"GHSA-745p-r637-7vvp","title":"Codeigniter4's Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued","description":"### Impact\nSetting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`.\n\n\u003e **Note**\n\u003e This vulnerability does not affect session cookies.\n\nThe following code does not issue a cookie with the secure flag even if you set `$secure = true` in `Config\\Cookie`.\n\n```php\nhelper('cookie');\n\n$cookie = [\n    'name'  =\u003e $name,\n    'value' =\u003e $value,\n];\nset_cookie($cookie);\n// or\n$this-\u003eresponse-\u003esetCookie($cookie);\n```\n\n### Patches\nUpgrade to v4.2.7 or later.\n\n### Workarounds\n1. Specify the options explicitly.\n   ```php\n   helper('cookie');\n\n   $cookie = [\n       'name'     =\u003e $name,\n       'value'    =\u003e $value,\n       'secure'   =\u003e true,\n       'httponly' =\u003e true,\n   ];\n   set_cookie($cookie);\n   // or\n   $this-\u003eresponse-\u003esetCookie($cookie);\n   ```\n2. Use Cookie object.\n   ```php\n   use CodeIgniter\\Cookie\\Cookie;\n\n   helper('cookie');\n\n   $cookie = new Cookie($name, $value);\n   set_cookie($cookie);\n   // or\n   $this-\u003eresponse-\u003esetCookie($cookie);\n   ```\n\n### References\n- https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie\n- https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter\\HTTP\\Response::setCookie\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)\n* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)\n","status":"published","published":"2022-10-06T20:01:41Z","modified":"2023-07-12T14:01:18Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-665","CWE-732"],"updated_at":"2026-11-02T14:36:56.605555Z"}],"nvd":[{"id":"CVE-2022-39284","description":"CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.","status":"published","published":"2022-10-06T20:15:35.56Z","modified":"2026-06-17T04:58:04.16Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-665","CWE-732"],"updated_at":"2026-11-02T14:07:29.026521Z"}],"osv":[{"id":"CVE-2022-39284","title":"Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued in Codeigniter4","description":"CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.","status":"published","published":"2022-10-06T00:00:00Z","modified":"2026-10-28T02:30:59.553552022Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-745p-r637-7vvp","title":"Codeigniter4's Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued","description":"### Impact\nSetting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`.\n\n\u003e **Note**\n\u003e This vulnerability does not affect session cookies.\n\nThe following code does not issue a cookie with the secure flag even if you set `$secure = true` in `Config\\Cookie`.\n\n```php\nhelper('cookie');\n\n$cookie = [\n    'name'  =\u003e $name,\n    'value' =\u003e $value,\n];\nset_cookie($cookie);\n// or\n$this-\u003eresponse-\u003esetCookie($cookie);\n```\n\n### Patches\nUpgrade to v4.2.7 or later.\n\n### Workarounds\n1. Specify the options explicitly.\n   ```php\n   helper('cookie');\n\n   $cookie = [\n       'name'     =\u003e $name,\n       'value'    =\u003e $value,\n       'secure'   =\u003e true,\n       'httponly' =\u003e true,\n   ];\n   set_cookie($cookie);\n   // or\n   $this-\u003eresponse-\u003esetCookie($cookie);\n   ```\n2. Use Cookie object.\n   ```php\n   use CodeIgniter\\Cookie\\Cookie;\n\n   helper('cookie');\n\n   $cookie = new Cookie($name, $value);\n   set_cookie($cookie);\n   // or\n   $this-\u003eresponse-\u003esetCookie($cookie);\n   ```\n\n### References\n- https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie\n- https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter\\HTTP\\Response::setCookie\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)\n* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)\n","status":"published","published":"2022-10-06T20:01:41Z","modified":"2024-02-16T08:04:07.612498Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-665","CWE-732"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"BIT-codeigniter-2022-39284","description":"CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.","status":"published","published":"2024-03-06T10:53:32.698Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:28.70813Z"}]}}