What is CVE-2023-48707?

CVE-2023-48707 is a medium-severity vulnerability in Codeigniter Shield, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.0/10. Published 2023-11-24.

How severe is CVE-2023-48707?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Vulnerability in Codeigniter Shield

CVE-2023-48707

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

EPSS: 0.003 (20.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N.

Affected products

Codeigniter Shield — versions 1.0.0
Codeigniter4 Shield — versions < 1.0.0-beta.8

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-48707?: CVE-2023-48707 is a medium-severity vulnerability in Codeigniter Shield, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.0/10. Published 2023-11-24.
How severe is CVE-2023-48707?: Medium severity. CVSS v3 base score is 5.0 out of 10.