PT-2024-40046 · Ez Systems · Ez Platform

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions eZ Platform version 2.3.x

Description The issue allows unauthenticated users to bypass permission checks and read user data, including names and emails, but not passwords or password hashes.

Recommendations For eZ Platform version 2.3.x, update "ezsystems/repository-forms" using Composer to the resolving version, or apply the patch manually.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-3G43-XFRW-PV5M

Affected Products

Ez Platform

References · 6

• https://osv.dev/vulnerability/GHSA-3g43-xfrw-pv5m · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/repository-forms/2018-11-20-1.yaml · Note
• https://github.com/ezsystems/repository-forms/commit/ea82e136ec1ea40aca714abb79cc8e5bfece01e8 · Note
• https://github.com/ezsystems/repository-forms · Note
• http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure · Note
• https://web.archive.org/web/20210614184249/http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure · Note