CVE-2023-48707CWE-312

Cleartext Storage of Sensitive Information in codeigniter4/shield

Medium · published November 24, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2023-11-24T17:23Z
EPSS history
Timeline
  • 24 NOV 17:23Z
    Cleartext Storage of Sensitive Information in codeigniter4/shield
    cvelistv5