CVE-2023-48707: codeigniter shield

csirt@kutim:~/threat-intel/cve/CVE-2023-48707

CVSS 6.5 · Medium EPSS 0,28%

Kerentanan Cleartext Storage of Sensitive Information pada codeigniter shield. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 24 November 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-312: Cleartext Storage of Sensitive Information
EPSS (30 hari): 0,28% peluang dieksploitasi; lebih tinggi dari 19,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
codeigniter	shield	Versi 1.0.0 beta
codeigniter	shield	Versi 1.0.0 beta2
codeigniter	shield	Versi 1.0.0 beta3
codeigniter	shield	Versi 1.0.0 beta4
codeigniter	shield	Versi 1.0.0 beta5
codeigniter	shield	Versi 1.0.0 beta6
codeigniter	shield	Versi 1.0.0 beta7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.