{"action":"Upgrade codeigniter4/framework to 4.2.7 or later.","affected":[{"fixed":"4.2.7","introduced":"0"}],"component":"codeigniter4/framework","cve_ids":["CVE-2022-39284"],"ecosystem":"Packagist","epss":0.01122,"exploited":false,"fixed_versions":["4.2.7"],"ghsa_id":"GHSA-745p-r637-7vvp","id":"tcs_01M5KEXNK0CA49VP1BJMKHC67P","modified_at":"2024-02-16T08:04:07.612498Z","published_at":"2022-10-06T20:01:41Z","references":["https://osv.dev/vulnerability/GHSA-745p-r637-7vvp","https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp","https://nvd.nist.gov/vuln/detail/CVE-2022-39284","https://github.com/codeigniter4/CodeIgniter4/issues/6540","https://github.com/codeigniter4/CodeIgniter4/pull/6544","https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie","https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie","https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies","https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-39284.yaml","https://github.com/codeigniter4/CodeIgniter4"],"severity":{"label":"low","score":2.6},"sources":[{"source":"osv","source_id":"GHSA-745p-r637-7vvp","url":"https://osv.dev/vulnerability/GHSA-745p-r637-7vvp"}],"summary":"Codeigniter4's Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued"}