CVE-2020-10793 CodeIgniter Improper Privilege Management
Attackers can gain privileges by modifying email IDs in a custom module, though the framework itself is disputed as the root cause.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10793?
CVE-2020-10793 is a high-severity vulnerability in n/a, published on 23 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself.
Weakness: CWE-269
Which versions are affected by CVE-2020-10793?
3 open source packages ship an affected version, including codeigniter4/framework and codeigniter. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codeigniter4/framework Packagist | All versions to 4.0.0 | None |
codeigniter4/framework Packagist | All versions to 4.0.0 | None |
codeigniter Bitnami | All versions | 4.0.0 |
Products include Codeigniter Codeigniter.
How do I fix CVE-2020-10793?
No fix published yet.
Is CVE-2020-10793 being exploited?
There is no known exploitation of CVE-2020-10793 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as BIT-codeigniter-2020-10793, GHSA-jwqp-wh5g-4gmm.