We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-46240

CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment



Description

CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.

Reserved 2023-10-19 | Published 2023-10-31 | Updated 2024-09-05 | Assigner GitHub_M


HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-209: Generation of Error Message Containing Sensitive Information

Product status

< 4.4.3
affected

References

github.com/...niter4/security/advisories/GHSA-hwxf-qxj7-7rfj

github.com/...ommit/423569fc31e29f51635a2e59c89770333f0e7563

codeigniter4.github.io/userguide/general/errors.html

cve.org (CVE-2023-46240)

nvd.nist.gov (CVE-2023-46240)

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-46240

Support options

Helpdesk Chat, Email, Knowledgebase
Subscribe to our newsletter to learn more about our work.