Codeigniter
CVE-2023-48707
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The secretKey value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
AnalysisAI
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-312. CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The secretKey value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. Affected products include: Codeigniter Shield. Version information: version 1.0.0.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Codeigniter
View allCodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today