CVE-2023-48708 Insertion of Sensitive Information into Log in codeigniter4/shield
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-48708?
CVE-2023-48708 is a medium-severity vulnerability in codeigniter4 shield, published on 24 Nov 2023.
Official description
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.
Weakness: CWE-532
Which versions are affected by CVE-2023-48708?
2 open source packages ship an affected version, including codeigniter4/shield. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codeigniter4/shield Packagist | All versions | 1.0.0-beta.8 |
codeigniter4/shield Packagist | All versions | 1.0.0-beta.8 |
Products include Codeigniter Shield.
How do I fix CVE-2023-48708?
Upgrade codeigniter4/shield to 1.0.0-beta.8 or later.
Is CVE-2023-48708 being exploited?
There is no known exploitation of CVE-2023-48708 in the wild and no public exploit code.
Other vulnerabilities in codeigniter4 shield
Sources
Also known as GHSA-j72f-h752-mx4w.