PT-2024-40319 · Ez Systems · Ez Platform

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions eZ Platform versions 2.x

Description The issue affects the password reset functionality in the eZ Platform Admin UI, making it vulnerable to brute force attacks. Depending on the configuration, an attacker may exploit this to gain control over user accounts. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited.

Recommendations For eZ Platform 2.5, update ezsystems/ezplatform-user to v1.0.1. For eZ Platform 2.4, update ezsystems/ezplatform-admin-ui to v1.4.6, ezsystems/ezplatform-admin-ui-modules to v1.4.4, and ezsystems/repository-forms to v2.4.5. As a temporary workaround, consider reducing the password reset request validity time to make attacks more difficult, ensuring enough time is left for email delivery delays and user delays.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

GHSA-HFPP-2VHW-QQ43

Affected Products

Ez Platform

References · 4

• https://osv.dev/vulnerability/GHSA-hfpp-2vhw-qq43 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-user/2019-04-03-1.yaml · Note
• https://github.com/ezsystems/ezplatform-user · Note
• https://web.archive.org/web/20201025103933/https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability · Note