Overview
- Description
- CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
Weaknesses
- security-advisories@github.com
- CWE-532
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1E3F1E0-C2D7-4EC5-AD04-AEB414A3D71C"
},
{
"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DDA8B62-EE63-40C0-9F2C-23F56B225F49"
},
{
"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F37B4E1-D641-4D55-9D3F-FB3B18934FE9"
},
{
"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3361F9CD-A084-4437-BF22-08A558C326B5"
},
{
"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEF20FB8-F114-4B54-8CEF-739433359E21"
},
{
"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "340EBC7C-51FC-4792-A0A4-A323219D1551"
},
{
"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "061CA3F7-EDAD-4D04-AFBC-9ABD22470AF1"
}
],
"operator": "OR"
}
]
}
]