CVE-2022-21715: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability (CVE-2022-21715) was discovered in the API\ResponseTrait component of CodeIgniter4, a PHP full-stack web framework, affecting versions prior to 4.1.8. The vulnerability was disclosed on January 24, 2022, and impacts applications using the API\ResponseTrait or ResourceController components (GitHub Advisory).

The vulnerability exists in the API\ResponseTrait component of CodeIgniter4 and has been assigned a CVSS v3.1 base score of 6.1 MEDIUM (NIST) and 5.4 MEDIUM (GitHub) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The vulnerability allows attackers to execute cross-site scripting attacks when the application uses the affected components (NVD).

If successfully exploited, this vulnerability could allow attackers to perform cross-site scripting (XSS) attacks against users of applications implementing the vulnerable components. This could lead to unauthorized access to user data and potential manipulation of web application content (GitHub Advisory).

The vulnerability has been patched in CodeIgniter4 version 4.1.8. Users are recommended to upgrade to this version or later. For those unable to upgrade immediately, two workarounds are available: avoid using API\ResponseTrait or ResourceController, or disable Auto Route and use defined routes only (GitHub Advisory).