CVE-2024-41344 Cross-site request forgery in n/a

What is CVE-2024-41344?

CVE-2024-41344 is a high-severity vulnerability in n/a, published on 15 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges.

Weakness: CWE-352

Which versions are affected by CVE-2024-41344?

It affects 1 product.

Products include Codeigniter Codeigniter.

How do I fix CVE-2024-41344?

No fix has been published for CVE-2024-41344 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-41344 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41344 exists.

Other vulnerabilities in n/a

• CVE-2025-54418 CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability Critical 9.8
• CVE-2023-32692 Remote Code Execution Vulnerability in Validation Placeholders Critical 9.8
• CVE-2022-40824 SQL injection in n/a Critical 9.8
• CVE-2022-40825 SQL injection in n/a Critical 9.8
• CVE-2022-40826 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2hwf-hm8p-fc5c.