PT-2022-28204 · Packagist · Ezsystems/Ezpublish-Kernel

Published 2022-04-29 · Updated 2022-04-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description A flawed update made object state limitations ineffective in releases since February 16th, 2022, allowing access to content regardless of the object state. The issue's severity depends on the frontend design, and knowing the URL to the content may or may not be required for access. If object state limitations are used in roles, this issue is critical.

Recommendations Apply the fix as soon as possible to resolve the issue.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

GHSA-5X4F-7XGQ-R42X

Affected Products

Ezsystems/Ezpublish-Kernel

References · 5

• https://osv.dev/vulnerability/GHSA-5x4f-7xgq-r42x · Vendor Advisory
• https://github.com/ezsystems/ezpublish-kernel/commit/133c33cbcaa330953d6283865153f3dfdc7a2e45 · Note
• https://github.com/ezsystems/ezpublish-kernel · Note
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-5x4f-7xgq-r42x · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-004-ineffective-object-state-limitation-and-unauthenticated-fastly-purge · Note