CVE-2023-27580highCWE-916

CVE-2023-27580: falha de alta gravidade em codeigniter4 shield

CodeIgniter Shield Password Shucking Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar shield+ Monitorar codeigniter4/shield

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user's password. Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database). There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
codeigniter4 · shield
CVEs relacionadas — codeigniter4 shield

No mesmo produto, das mais perigosas para as menos.

CVE-2023-48708MEDIUMInsertion of Sensitive Information into Log in codeigniter4/shieldEPSS 0.6%CVE-2022-35943MEDIUMSameSite may allow cross-site request forgery (CSRF) protection to be bypassedEPSS 0.6%CVE-2023-48707MEDIUMCleartext Storage of Sensitive Information in codeigniter4/shieldEPSS 0.3%