CVE-2023-46240
Summary
| CVE | CVE-2023-46240 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-10-31 16:15:00 UTC |
|---|
| Updated | 2023-11-08 23:43:00 UTC |
|---|
| Description | CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Error Handling — CodeIgniter 4.3.2 documentation |
MISC |
codeigniter4.github.io |
|
| Merge pull request from GHSA-hwxf-qxj7-7rfj · codeigniter4/CodeIgniter4@423569f · GitHub |
MISC |
github.com |
|
| Detailed Error Report is Displayed in Production Environment · Advisory · codeigniter4/CodeIgniter4 · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 995767 PHP (Composer) Security Update for codeigniter4/framework (GHSA-hwxf-qxj7-7rfj)
