Vulnerability Description
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Codeigniter | Codeigniter | <= 4.0.0 |
Related Weaknesses (CWE)
References
- https://codeigniter4.github.io/userguide/extending/authentication.htmlVendor Advisory
- https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeignite
- https://codeigniter4.github.io/userguide/extending/authentication.htmlVendor Advisory
- https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeignite
FAQ
What is CVE-2020-10793?
CVE-2020-10793 is a vulnerability with a CVSS score of 8.8 (HIGH). CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the iss...
How severe is CVE-2020-10793?
CVE-2020-10793 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10793?
Check the references section above for vendor advisories and patch information. Affected products include: Codeigniter Codeigniter.