CVE-2023-48707

MEDIUM Year: 2023
CVSS v3 Score
6.5
Medium
Weakness Type
CWE-312
View all →

Vulnerability Description

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Related Vulnerabilities

CVE-2016-3192

MEDIUM
CVSS:6.5(Medium)

Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

CWE-3122016

CVE-2017-14990

MEDIUM
CVSS:6.5(Medium)

WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack un...

CWE-3122017

CVE-2018-11242

MEDIUM
CVSS:6.5(Medium)

An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as dem...

CWE-3122018

CVE-2018-2028

MEDIUM
CVSS:6.5(Medium)

IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive information. IBM X-Force ID:...

CWE-3122018

CVE-2019-13021

MEDIUM
CVSS:6.5(Medium)

The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwo...

CWE-3122019

CVE-2019-13099

MEDIUM
CVSS:6.5(Medium)

The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out the username/password of a valid user and...

CWE-3122019