CVE-2023-46240
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.
Reserved 2023-10-19 | Published 2023-10-31 | Updated 2024-09-05 | Assigner GitHub_MCWE-209: Generation of Error Message Containing Sensitive Information
github.com/...niter4/security/advisories/GHSA-hwxf-qxj7-7rfj
github.com/...ommit/423569fc31e29f51635a2e59c89770333f0e7563
codeigniter4.github.io/userguide/general/errors.html
Support options
