CVE-2023-46240: CodeIgniter Information Disclosure Vulnerability
Summary
CVE-2023-46240: CodeIgniter is a PHP full-stack web framework. Affects codeigniter versions < 4.4.3. Fixed in 4.4.3. How to fix ↓
Also tracked for
- codeigniter4/framework · Packagist
The same CVE-2023-46240 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a PHP full-stack web framework that provides developers with a robust set of tools for building web applications. It offers features such as a Model-View-Controller (MVC) architecture, database abstraction, and security functionalities. However, prior to version 4.4.3, CodeIgniter had a vulnerability that allowed detailed error reports to be displayed even in the production environment. This could potentially lead to the leakage of confidential information.
Vulnerability Detail
The vulnerability in CodeIgniter (prior to version 4.4.3) allowed detailed error reports to be shown in the production environment. This means that if an error or exception occurred, sensitive information could be exposed to attackers. This could include database credentials, file paths, or other confidential data. The impact of this vulnerability is high, as it can potentially lead to unauthorized access or further exploitation of the system.
How To Fix
Minimum fixed version
4.4.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the 'production.php' file in the 'app/Config/Boot' directory of your CodeIgniter installation. Replace the line 'ini_set('display_errors', '0')' with 'ini_set('display_errors', 'Off')'. This will disable the display of error reports in the production environment. However, it is still recommended to upgrade to the latest version for a permanent fix.
Conclusion
The CodeIgniter information disclosure vulnerability (CVE-2023-46240) allows detailed error reports to be displayed in the production environment, potentially exposing sensitive information. To fix this vulnerability, it is recommended to upgrade to CodeIgniter version 4.4.3 or later. A temporary workaround is available by modifying the 'production.php' file. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter →
FAQ
CodeIgniter is a PHP full-stack web framework that provides developers with a set of tools for building web applications. It follows the Model-View-Controller (MVC) architectural pattern and offers features such as database abstraction and security functionalities.
The vulnerability in CodeIgniter allows detailed error reports to be displayed in the production environment, potentially exposing sensitive information. This can lead to unauthorized access or further exploitation of the system.
To fix this vulnerability, it is recommended to upgrade to CodeIgniter version 4.4.3 or later. This version contains a patch that prevents the display of detailed error reports in the production environment.
Yes, there is a temporary workaround available. You can modify the 'production.php' file in the 'app/Config/Boot' directory of your CodeIgniter installation. Replace the line 'ini_set('display_errors', '0')' with 'ini_set('display_errors', 'Off')'. However, it is still recommended to upgrade to the latest version for a permanent fix.
You can find more information about this vulnerability in the CodeIgniter vulnerability database. Please refer to the provided source link for detailed information.
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter.
