PT-2023-33021 · Ibexa+1 · Ibexa/Core+4

Published 2023-11-03 · Updated 2023-11-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Ibexa DXP and eZ Platform (affected versions not specified) ezsystems/ezplatform-kernel (affected versions not specified) ezsystems/ezpublish-kernel (affected versions not specified) ibexa/core (affected versions not specified)

Description The issue is related to the route used for file downloads, which allows specifying the name of the downloaded file. This could lead to misunderstandings, confusion, and possibly other harm. The issue affects installations where downloadable files exist.

Recommendations For Ibexa DXP and eZ Platform, update to a version that includes the fix for the issue. For ezsystems/ezplatform-kernel, update to a patched version. For ezsystems/ezpublish-kernel and ibexa/core, refer to the advisory published for those repositories. As a temporary workaround, consider blocking all downloads until a patch is available.

Related Identifiers

GHSA-GV2C-5G79-H73C

Affected Products

Ibexa Dxp

Ez Platform

Ezplatform-Kernel

Ezpublish-Kernel

Ibexa/Core

References · 5

• https://osv.dev/vulnerability/GHSA-gv2c-5g79-h73c · Vendor Advisory
• https://github.com/ezsystems/ezplatform-kernel/commit/affa2520e5e986e477ca7f7c93b9ca2c30188063 · Note
• https://github.com/ezsystems/ezplatform-kernel · Note
• https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-gv2c-5g79-h73c · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2023-005-vulnerabilities-in-solr-search-and-file-downloads · Note