CVE-2023-48707: Cleartext Storage of Sensitive Information in codeigniter4/shield
First published: Thu Nov 23 2023(Updated: )
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/codeigniter4/shield | <1.0.0-beta.8 | 1.0.0-beta.8 |
| CodeIgniter Shield | =1.0.0-beta | |
| CodeIgniter Shield | =1.0.0-beta2 | |
| CodeIgniter Shield | =1.0.0-beta3 | |
| CodeIgniter Shield | =1.0.0-beta4 | |
| CodeIgniter Shield | =1.0.0-beta5 | |
| CodeIgniter Shield | =1.0.0-beta6 | |
| CodeIgniter Shield | =1.0.0-beta7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-48707?
The severity of CVE-2023-48707 is medium.
How does CVE-2023-48707 impact codeigniter4/shield?
CVE-2023-48707 allows a malicious person with access to the database to impersonate others using the secretKey for HMAC SHA256 authentication.
How do I fix CVE-2023-48707?
To fix CVE-2023-48707, update codeigniter4/shield to version 1.0.0-beta.8.
Where can I find more information about CVE-2023-48707?
You can find more information about CVE-2023-48707 at the following references: [GitHub Advisory](https://github.com/codeigniter4/shield/security/advisories/GHSA-v427-c49j-8w6x), [GitHub Commit](https://github.com/codeigniter4/shield/commit/f77c6ae20275ac1245330a2b9a523bf7e6f6202f), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-48707).
What is the CWE ID for CVE-2023-48707?
The CWE ID for CVE-2023-48707 is 312.
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-v427-c49j-8w6x
- alias/CVE-2023-48707
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory
- package-manager/composer
- vendor/codeigniter
- product/shield
- canonical/codeigniter shield