PT-2023-33002 · Ez Systems +1 · Ezpublish-Kernel +2

Published 2023-11-03 · Updated 2023-11-03

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions:

Ibexa DXP and eZ Platform (affected versions not specified)

ezsystems/ezpublish-kernel (affected versions not specified)

Description:

The issue allows specifying the name of the downloaded file in the route used for file downloads, which could lead to misunderstandings and confusion, and possibly other harm. This is due to an unintended side effect of the implementation. The issue affects installations where downloadable files exist.

Recommendations:

For Ibexa DXP and eZ Platform, update to a version that includes the fix for the issue.

For ezsystems/ezpublish-kernel, update to a patched version.

As a temporary workaround, consider blocking all downloads until a patch is available.

Related Identifiers

GHSA-946C-F9W6-2C25

Affected Products

Ibexa Dxp

Ez Platform

Ezpublish-Kernel

References · 4

• https://osv.dev/vulnerability/GHSA-946c-f9w6-2c25 · Vendor Advisory
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-946c-f9w6-2c25 · Note
• https://github.com/ezsystems/ezpublish-kernel · Note
• https://github.com/ezsystems/ezpublish-kernel/commit/142152f9bae4c4835713df0bdfe22bc98d03f9a1 · Note