6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
7 High
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.1%
secretKey, an important key for HMAC SHA256 authentication, was stored in the database in raw form.
If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that person.
Upgrade to Shield v1.0.0-beta.8 or later.
After upgrading, all existing secret keys must be encrypted.
See https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.
None.
If you have any questions or comments about this advisory:
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
7 High
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.1%