GitHub Advisoryadvisory · Packagist

GHSA-hwxf-qxj7-7rfj CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

HIGH Published 2023-10-30 Modified 2023-10-30 Official page ↗
Aliases
CVE-2023-46240
Ecosystem
Packagist
Packages
codeigniter4/framework
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2023-10-30

Affected packages

• Packagist codeigniter4/framework: < 4.4.3 → fixed in 4.4.3

Description

Impact If an error or exception occurs in CodeIgniter4 v4.4.2 and earlier, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Patches Upgrade to v4.4.3 or later. See upgrading guide. Workarounds Replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`. For more information If you have any questions or comments about this advisory: • Open an issue in codeigniter4/CodeIgniter4 • Email us at SECURITY.md

Related

Alias · CVE (1)

  • CVE-2023-46240 CodeIgniter is a PHP full-stack web framework. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References