PT-2021-24423 · Ibexa · Ibexa Open Source+2

Published 2021-03-11 · Updated 2021-03-11

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: eZ Platform versions 1.13, 2.5, and 3.2 Ibexa DXP and Ibexa Open Source version 3.3

Description: A security issue exists where the "/user/sessions" endpoint can be exploited to detect if a given username or email refers to a valid account. This can be achieved by analyzing differences in the response data or response time of certain requests.

Recommendations: For eZ Platform versions 1.13, 2.5, and 3.2, update via Composer to ensure the fix is applied. For Ibexa DXP and Ibexa Open Source version 3.3, update via Composer to ensure the fix is applied. As a temporary workaround, consider restricting access to the "/user/sessions" endpoint until the issue is resolved.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

GHSA-GMRF-99GW-VVWJ

Affected Products

Ibexa Dxp

Ibexa Open Source

Ez Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-46876 · Security Note
• https://osv.dev/vulnerability/GHSA-gmrf-99gw-vvwj · Vendor Advisory
• https://github.com/ezsystems/ezpublish-kernel · Note
• https://github.com/ezsystems/ezpublish-kernel/commit/b496f073c3f03707d3531a6941dc098b84e3cbed · Note
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-gmrf-99gw-vvwj · Note
• https://packagist.org/packages/ezsystems/ezpublish-kernel · Note