{"id":"GHSA-g434-3q2j-hj4r","summary":"CodeIgniter Session Fixation Vulnerability","details":"A Session Fixation issue exists in CodeIgniter before 3.1.10 because `session.use_strict_mode` in the Session Library was mishandled.","aliases":["CVE-2018-12071"],"modified":"2025-06-17T14:31:48.904926Z","published":"2022-05-14T03:08:36Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-07-25T21:28:58Z","nvd_published_at":"2018-06-17T20:29:00Z","cwe_ids":["CWE-384"],"severity":"CRITICAL"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12071"},{"type":"WEB","url":"https://github.com/bcit-ci/CodeIgniter/issues/5958"},{"type":"WEB","url":"https://github.com/bcit-ci/CodeIgniter/commit/800a20d6c4662d99ae0988b2f8f2238bb8bb29db"},{"type":"WEB","url":"https://github.com/bcit-ci/CodeIgniter/commit/a9da3dd2f16a8f97d7bc4ff5572b28e4bb84c813#diff-32788a4d3748e8818044886ab43241179c7f5f5b82e979e73146669ca6e2da1cR306"},{"type":"PACKAGE","url":"https://github.com/bcit-ci/CodeIgniter"},{"type":"WEB","url":"https://web.archive.org/web/20181115214804/https://www.codeigniter.com/user_guide/changelog.html#version-3-1-9"},{"type":"WEB","url":"https://www.codeigniter.com/user_guide/changelog.html"}],"affected":[{"package":{"name":"codeigniter/framework","ecosystem":"Packagist","purl":"pkg:composer/codeigniter/framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10"}]}],"versions":["3.0.0","3.0.1","3.0.1rc","3.0.1rc2","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0rc","3.0rc2","3.0rc3","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g434-3q2j-hj4r/GHSA-g434-3q2j-hj4r.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}