PT-2024-40231 · Ez Systems · Ezpublish-Kernel

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: ezsystems/ezpublish-kernel (affected versions not specified)

Description: The issue concerns the REST API potentially disclosing the names of all available site accesses, with severity depending on the specific installation.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-9WWX-C723-VM8X

Affected Products

Ezpublish-Kernel

References · 6

• https://osv.dev/vulnerability/GHSA-9wwx-c723-vm8x · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-kernel/2018-11-21-1.yaml · Note
• https://github.com/ezsystems/ezpublish-kernel/commit/1551723ec134878a4cb598bfc5d900ba6164117a · Note
• https://github.com/ezsystems/ezpublish-kernel · Note
• https://web.archive.org/web/20210614181629/https://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses · Note
• http://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses · Note