CVE-2023-48708

MEDIUM EPSS 45.7%
Published Nov 24, 20232y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Nov 24, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
45.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-532

Affected Products 7

VendorProductVersionRange
codeignitershield1.0.0any
codeignitershield1.0.0any
codeignitershield1.0.0any
codeignitershield1.0.0any
codeignitershield1.0.0any
codeignitershield1.0.0any
codeignitershield1.0.0any

References 3

  • codeigniter4.github.io https://codeigniter4.github.io/shield/getting_started/authenticators/
    Product
  • github.com https://github.com/codeigniter4/shield/commit/7e84c3fb3411294f70890819bfe51781bb9dc8e4
    Patch
  • github.com https://github.com/codeigniter4/shield/security/advisories/GHSA-j72f-h752-mx4w
    MitigationVendor Advisory

Remediation

  • github.com https://github.com/codeigniter4/shield/commit/7e84c3fb3411294f70890819bfe51781bb9dc8e4
    Patch