Security readout for executives and security teams
Plain-English summary
CVE-2013-4891 is an XSS filter bypass in CodeIgniter's xss_clean before 2.1.4. Malformed HTML could evade intended cleanup and allow script execution in a user's browser. Business impact depends on whether legacy CodeIgniter applications process untrusted HTML and display filtered input.
Executive priority
Treat this as a legacy application risk. It is not currently supported by KEV evidence in the provided sources, but affected public or authenticated web apps could expose users to session theft, phishing, or content manipulation.
Technical view
The public record describes a bypass of CodeIgniter's xss_clean protection using an unclosed HTML tag. No CVSS, CWE, or detailed affected CPE data is supplied. The version boundary given is CodeIgniter before 2.1.4, with vendor changelog and issue references available.
Likely exposure
Exposure is most likely in legacy CodeIgniter applications older than 2.1.4 that rely on xss_clean as their primary XSS defense for user-controlled content.
Exploitation context
The sources describe a remote attacker bypassing an intended protection mechanism to conduct XSS. The bundle does not cite CISA KEV listing, active exploitation, public exploitation volume, or in-the-wild campaigns.
Researcher notes
Evidence is clear on the vulnerable function and version boundary, but incomplete on CVSS, CWE mapping, affected CPEs, and exploitation status. Validate actual risk by locating legacy CodeIgniter instances and determining whether xss_clean-protected content reaches browser output.
Mitigation direction
- Identify any CodeIgniter applications older than 2.1.4.
- Upgrade affected CodeIgniter deployments to 2.1.4 or later where feasible.
- Review vendor changelog and project issue guidance before applying changes.
- Avoid relying solely on xss_clean for output safety.
- Apply contextual output encoding for rendered user-controlled content.
Validation and detection
- Inventory application framework versions and confirm CodeIgniter release numbers.
- Search code for xss_clean usage around user-controlled input.
- Review pages that render filtered HTML or rich text.
- Confirm upgrade status against the CodeIgniter 2.1.4 boundary.
- Run safe XSS regression tests in authorized test environments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2013-4891 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://nealpoole.com/blog/2013/07/codeigniter-21-xss-clean-filter-bypass/CVE reference · x_refsource_MISC
- https://github.com/bcit-ci/CodeIgniter/issues/4020CVE reference · x_refsource_CONFIRM
- https://www.codeigniter.com/userguide2/changelog.htmlCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.