GHSA-hwxf-qxj7-7rfj: CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

Package

composer codeigniter4/framework (Composer)

Affected versions

<= 4.4.2

Patched versions

4.4.3

Description

Impact

If an error or exception occurs in CodeIgniter4 v4.4.2 and earlier, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked.

Patches

Upgrade to v4.4.3 or later. See upgrading guide.

Workarounds

Replace ini_set('display_errors’, ‘0’) with ini_set('display_errors’, ‘Off’) in app/Config/Boot/production.php.

For more information

If you have any questions or comments about this advisory:

• Open an issue in codeigniter4/CodeIgniter4
• Email us at SECURITY.md

References

• GHSA-hwxf-qxj7-7rfj
• codeigniter4/CodeIgniter4@423569f
• https://codeigniter4.github.io/userguide/general/errors.html#error-reporting

kenjis published to codeigniter4/CodeIgniter4

Oct 26, 2023

Published to the GitHub Advisory Database

Oct 30, 2023

Reviewed

Oct 30, 2023

Last updated

Oct 30, 2023