{"action":"Upgrade codeigniter4/shield to 1.0.0-beta.4 or later.","affected":[{"fixed":"1.0.0-beta.4","introduced":"0"}],"component":"codeigniter4/shield","cve_ids":["CVE-2023-27580"],"ecosystem":"Packagist","epss":0.00517,"exploited":false,"fixed_versions":["1.0.0-beta.4"],"ghsa_id":"GHSA-c5vj-f36q-p9vg","id":"tcs_01M5KF0MR06410MM4D2TY037JN","modified_at":"2023-11-08T04:12:06.767774Z","published_at":"2023-03-13T20:51:07Z","references":["https://osv.dev/vulnerability/GHSA-c5vj-f36q-p9vg","https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg","https://nvd.nist.gov/vuln/detail/CVE-2023-27580","https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b","https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html","https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords","https://github.com/codeigniter4/shield","https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md","https://www.scottbrady91.com/authentication/beware-of-password-shucking"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-c5vj-f36q-p9vg","url":"https://osv.dev/vulnerability/GHSA-c5vj-f36q-p9vg"}],"summary":"Password Shucking Vulnerability"}