CVE-2023-46240
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
| Assigner | GitHub_M |
| Reserved | 2023-10-19 |
| Published | 2023-10-31 |
| Updated | 2024-09-05 |
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.
| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CWE-209: Generation of Error Message Containing Sensitive Information
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hwxf-qxj7-7rfj
https://github.com/codeigniter4/CodeIgniter4/commit/423569fc31e29f51635a2e59c89770333f0e7563
https://codeigniter4.github.io/userguide/general/errors.html#error-reporting
