CVE-2023-48708

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
codeigniter4shield< 1.0.0-beta.8

References

Timeline

Published
Nov 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-487098.0iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include mCVE-2023-48719.8A vulnerability classified as critical was found in SourceCodester Contact Manager App 1.0. This vulnerability affects unknown code of the fCVE-2023-487109.8iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted CVE-2023-487113.7google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) VulnCVE-2023-487128.8Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability tCVE-2023-487135.3Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker whCVE-2023-487144.3Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1CVE-2023-487155.4Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap CommCVE-2023-487169.8Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_id' parameter of tCVE-2023-487189.8Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter ofCVE-2023-48729.8A vulnerability, which was classified as critical, has been found in SourceCodester Contact Manager App 1.0. This issue affects some unknownCVE-2023-487209.8Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of t
CVE-2023-48708: Medium severity, CVSS 6.5 | Vulnix