CVE-2023-27580highCWE-916

CVE-2023-27580: fallo de gravedad alta en codeigniter4 shield

CodeIgniter Shield Password Shucking Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear shield+ Monitorear codeigniter4/shield

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.5%
CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user's password. Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database). There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
codeigniter4 · shield
CVEs relacionadas — codeigniter4 shield

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-48708MEDIUMInsertion of Sensitive Information into Log in codeigniter4/shieldEPSS 0.6%CVE-2022-35943MEDIUMSameSite may allow cross-site request forgery (CSRF) protection to be bypassedEPSS 0.6%CVE-2023-48707MEDIUMCleartext Storage of Sensitive Information in codeigniter4/shieldEPSS 0.3%