p PatchFirst

CVE-2023-48708

CVE-2023-48708 · Insertion of Sensitive Information into Log in codeigniter4/shield

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.

CVSS 5.0 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • shield

    Versions
    • < 1.0.0-beta.8: Affected

    No fix published

  • codeigniter4/shield Packagist

    Versions
    • v1.0.0-beta
    • v1.0.0-beta.2
    • v1.0.0-beta.3
    • v1.0.0-beta.4
    • v1.0.0-beta.5
    • v1.0.0-beta.6
    • v1.0.0-beta.7
    Affected ranges
    • ECOSYSTEM: < 1.0.0-beta.8

    Update to 1.0.0-beta.8

Original sources

Check your server →