CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
Résumé
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
Description d'origine
La description telle que publiée par la source (souvent en anglais).
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace ini_set('display_errors', '0') with ini_set('display_errors', 'Off') in app/Config/Boot/production.php.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web codeigniter4.github.io