We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-46240

CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment



AssignerGitHub_M
Reserved2023-10-19
Published2023-10-31
Updated2024-09-05

Description

CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.



HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-209: Generation of Error Message Containing Sensitive Information

Product status

< 4.4.3
affected

References

https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hwxf-qxj7-7rfj

https://github.com/codeigniter4/CodeIgniter4/commit/423569fc31e29f51635a2e59c89770333f0e7563

https://codeigniter4.github.io/userguide/general/errors.html#error-reporting

cve.org CVE-2023-46240

nvd.nist.gov CVE-2023-46240

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-46240
Subscribe to our newsletter to learn more about our work.