PT-2023-12597 · Ibexa · Ibexa Dxp+3
Publicado
2021-03-11
·
Atualizado
2025-03-05
·
CVE-2021-46876
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
eZ Publish Ibexa Kernel versions prior to 7.5.15.1
eZ Platform versions 1.13, 2.5, and 3.2
Ibexa DXP and Ibexa Open Source version 3.3
Description
An issue was discovered that allows the "/user/sessions" endpoint to be abused, enabling an attacker to determine if a given account exists. This can be achieved by analyzing differences in response data or response time from certain requests.
Recommendations
For eZ Publish Ibexa Kernel versions prior to 7.5.15.1, update to version 7.5.15.1 or later.
For eZ Platform versions 1.13, 2.5, and 3.2, update using Composer to receive the fix.
For Ibexa DXP and Ibexa Open Source version 3.3, update using Composer to receive the fix.
As a temporary workaround, consider restricting access to the "/user/sessions" endpoint to minimize the risk of exploitation.
Correção
Side Channel Attack
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ibexa Dxp
Ibexa Open Source
Ez Platform
Ez Publish Ibexa Kernel