PT-2024-40383 · Unknown · Ezplatform-Kernel

Published 2024-03-20 · Updated 2024-03-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ezplatform-kernel (affected versions not specified)

Description The issue allows unwanted file types to be stored even if they are not easily accessible due to the content not being published. This occurs when file validation is configured to reject certain files by file type, but the file can still be saved when saving the content draft. An attacker would need existing access to create content with a file field type to exploit this.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

GHSA-MWVH-P3HX-X4GG

Affected Products

Ezplatform-Kernel

References · 5

• https://osv.dev/vulnerability/GHSA-mwvh-p3hx-x4gg · Vendor Advisory
• https://github.com/ezsystems/ezplatform-kernel · Note
• https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-mwvh-p3hx-x4gg · Note
• https://github.com/ezsystems/ezplatform-kernel/commit/7e472317f7c75f45f72f74c38406952d8bea0de1 · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-002-file-validation-and-workflow-stages · Note