CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure ConfigApp::$proxyIPs. As a workaround, do not use $request->getIPAddress().
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Codeigniter | Codeigniter | 4.0.0 (including) | 4.2.11 (excluding) |