CVE-2022-46170

CVE-2022-46170 is a critical vulnerability affecting CodeIgniter, a PHP web framework, specifically when using multiple session cookies with DatabaseHandler, MemcachedHandler, or RedisHandler. An attacker who obtains one session cookie can potentially gain unauthorized access to pages requiring a different session cookie, leading to full compromise of confidentiality, integrity, and availability. While rated 9.8 CRITICAL with a FAUCET Risk Score of 78/100, there is currently no evidence of active exploitation, public exploit code, or significant community discussion. Organizations should upgrade to CodeIgniter version 4.2.11 or later, or as a workaround, use only one session cookie.