PT-2023-33018 · Ibexa · Ez Platform+1

Publicado 2023-11-03 · Atualizado 2023-11-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Ibexa DXP and eZ Platform versions (affected versions not specified)

Description The issue allows specifying the name of the downloaded file in the route used for file downloads, which could lead to misunderstandings, confusion, and possibly other harm. This is due to an unintended side effect of the implementation. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For all supported versions of Ibexa DXP and eZ Platform, update ibexa/core to the patched version. As a temporary workaround, consider blocking all downloads until the issue is resolved.

Identificadores relacionados

GHSA-G95C-XC83-8353

Produtos afetados

Ibexa Dxp

Ez Platform

Referências · 4

• https://github.com/ibexa/core/commit/704f221031ea4e32bd5510fe4c1fa8e0f664cbd4 · Nota
• https://github.com/ibexa/core · Nota
• https://github.com/ibexa/core/security/advisories/GHSA-g95c-xc83-8353 · Nota
• https://osv.dev/vulnerability/GHSA-g95c-xc83-8353 · Aviso do Fabricante