Vulnerability · Published Nov 24, 2023 · Assigned by GitHub_M
CVE-2023-48708Insertion of Sensitive Information into Log in codeigniter4/shield
Medium 5.0
In plain English
A medium-severity sensitive data in logs in shield from codeigniter4. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | codeigniter4/shield | 1.0.0-beta.8 | GHSA-j72f-h752-mx4w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| codeigniter4 | shield | < 1.0.0-beta.8 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N