| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| codeigniter4/shield | < 1.0.0-beta.8 | 1.0.0-beta.8 |
| shield | = 1.0.0 |
If successful login attempts are recorded, the raw tokens are stored in the log table. If a malicious person somehow views the data in the log table, he or she can obtain a raw token, which can then be used to send a request with that user's authority.
When you (1) use the following authentiactors,
tokens)jwt)hmac)and you (2) log successful login attempts, the raw tokens are stored.
Upgrade to Shield v1.0.0-beta.8 or later.
Disable logging for successful login attempts by the configuration files.
Config\AuthToken::$recordLoginAttempt to Auth::RECORD_LOGIN_ATTEMPT_FAILURE or Auth::RECORD_LOGIN_ATTEMPT_NONEConfig\AuthJWT::$recordLoginAttempt to Auth::RECORD_LOGIN_ATTEMPT_FAILURE or Auth::RECORD_LOGIN_ATTEMPT_NONEIf you have any questions or comments about this advisory:
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí