CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
概要
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace ini_set('display_errors', '0') with ini_set('display_errors', 'Off') in app/Config/Boot/production.php.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web codeigniter4.github.io