Codeigniter
CVE-2023-48708
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.
AnalysisAI
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-532. CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files. Affected products include: Codeigniter Shield. Version information: version 1.0.0.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Codeigniter
View allCodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
B.C. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low att
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today