CVE-2020-10793: Improper Privilege Management

March 23, 2020 (updated February 10, 2021)

CodeIgniter allows remote attackers to gain privileges via a modified Email ID to the “Select Role of the User” page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library.

References

codeigniter4.github.io/userguide/extending/authentication.html
nvd.nist.gov/vuln/detail/CVE-2020-10793

Code Behaviors & Features

Detect and mitigate CVE-2020-10793 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →