CVE-2023-48708CWE-532

Insertion of Sensitive Information into Log in codeigniter4/shield

Medium · published November 24, 2023

CVSS v3.1
5.0
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.6th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2023-11-24T17:16Z
EPSS history
Timeline
  • 24 NOV 17:16Z
    Insertion of Sensitive Information into Log in codeigniter4/shield
    cvelistv5