CVE-2023-48708

Katalog CVE

CVSS 6.5 · Medium EPSS 0,63%

Kerentanan Insertion of Sensitive Information into Log File pada codeigniter shield. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.

Rincian

Terbit di NVD

24 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/codeigniter4/shield/security/advisories/GHSA-j72f-h752-mx4w mitigasi · advisory vendor
• https://github.com/codeigniter4/shield/commit/7e84c3fb3411294f70890819bfe51781bb9dc8e4 patch
• https://codeigniter4.github.io/shield/getting_started/authenticators/ product