PT-2024-40063 · Ez Systems · Ez Platform

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions eZ Platform versions prior to 2.5.4 eZ Platform version 3.0.0 and earlier

Description The issue concerns a potential vulnerability in the eZ Platform log in form, where the Cross-Site Request Forgery (CSRF) token is present but the CSRF functionality is not enabled by default. This means the token is inactive.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. For version 3.0.0 and earlier, consider manually enabling the CSRF functionality by editing the security configuration file, setting the csrf token generator key to security.csrf.token manager. As a temporary workaround, consider manually enabling the CSRF token in your configuration until a patch is available.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

GHSA-45QM-J4M9-WHV9

Affected Products

Ez Platform

References · 5

• https://osv.dev/vulnerability/GHSA-45qm-j4m9-whv9 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform/2019-06-27-1.yaml · Note
• https://github.com/ezsystems/ezplatform · Note
• https://web.archive.org/web/20210614185223/https://share.ez.no/community-project/security-advisories/ezsa-2019-004-csrf-token-in-login-form-is-disabled-by-default · Note
• https://share.ez.no/community-project/security-advisories/ezsa-2019-004-csrf-token-in-login-form-is-disabled-by-default · Note