CVE-2023-46240— CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-46240
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
Source: CVE Program / CVE List V5
Vulnerability Description
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
CodeIgniter 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CodeIgniter是一款使用PHP语言编写的开源Web框架。 CodeIgniter 4.4.3之前版本存在安全漏洞。攻击者利用该漏洞获取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| codeigniter4 | CodeIgniter4 | < 4.4.3 | - |
II. Public POCs for CVE-2023-46240
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7329 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2023-46240
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-46240 (1)
Vendor Advisories for CVE-2023-46240 (1)
Security Blog Posts for CVE-2023-46240 (1)
IV. Related Vulnerabilities
Same product: CodeIgniter4
- CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is - CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when usi - CVE-2026-63221
CodeIgniter: SQL injection is possible via Query Builder del - CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRe - CVE-2026-48062
CodeIgniter: Uploaded file extension validation bypass in `e
Same vendor: codeigniter4
- CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is - CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when usi - CVE-2026-63221
CodeIgniter: SQL injection is possible via Query Builder del - CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRe - CVE-2026-48062
CodeIgniter: Uploaded file extension validation bypass in `e
Same weakness: CWE-209
- CVE-2026-73844
CKAN MCP Server: Information disclosure via verbose error re - CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure - CVE-2026-56620
HCL BigFix Mobile is vulnerable to information disclosure - CVE-2026-47622
NVIDIA Dynamo 信息泄露漏洞 - CVE-2026-56571
HCL iControl is affected by multiple security vulnerabilitie
V. Comments for CVE-2023-46240
No comments yet