PT-2022-28284 · Packagist · Ezsystems/Ezplatform-Kernel

Published 2022-04-29 · Updated 2022-04-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description A flawed update made object state limitations ineffective, granting access to content regardless of the object state. This issue is critical for users who rely on object state limitations in their roles. The level of access depends on the frontend design, and knowing the URL to the content may or may not be required.

Recommendations Apply the fix as soon as possible to resolve the issue. If you are using object state limitations in your roles, consider restricting access to sensitive content until the fix is applied.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

GHSA-W8QP-HMH5-4V9V

Affected Products

Ezsystems/Ezplatform-Kernel

References · 4

• https://osv.dev/vulnerability/GHSA-w8qp-hmh5-4v9v · Vendor Advisory
• https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-w8qp-hmh5-4v9v · Note
• https://github.com/ezsystems/ezplatform-kernel · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-004-ineffective-object-state-limitation-and-unauthenticated-fastly-purge · Note