PT-2023-33018 · Ibexa · Ez Platform+1
Published
2023-11-03
·
Updated
2023-11-03
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Ibexa DXP and eZ Platform versions (affected versions not specified)
Description
The issue allows specifying the name of the downloaded file in the route used for file downloads, which could lead to misunderstandings, confusion, and possibly other harm. This is due to an unintended side effect of the implementation. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
Recommendations
For all supported versions of Ibexa DXP and eZ Platform, update ibexa/core to the patched version.
As a temporary workaround, consider blocking all downloads until the issue is resolved.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ibexa Dxp
Ez Platform