CVE-2022-23556

Description

### Impact This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy. ### Patches Upgrade to v4.2.11 or later, and configure `Config\App::$proxyIPs`. ### Workarounds Do not use `$request->getIPAddress()`. ### References - https://codeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress ### For more information If you have any questions or comments about this advisory: * Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues) * Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)

How to fix CVE-2022-23556

To remediate CVE-2022-23556, upgrade the affected package to a fixed version below.

• —upgrade to 4.2.11 or later
• —upgrade to 4.2.11 or later

Is CVE-2022-23556 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 4.0.0, < 4.2.11
• from 0, < 4.2.11

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-23556
• PATCHgithub.com/codeigniter4/CodeIgniter4
• WEBcodeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress
• WEBgithub.com/codeigniter4/CodeIgniter4/commit/5ca8c99b2db09a2a08a013836628028ddc984659