PT-2024-40396 · Ez Systems · Ez Publish Legacy

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions eZ Publish Legacy (affected versions not specified)

Description The issue concerns a failure of the standard login handler to verify passwords correctly in certain configurations, potentially allowing unauthorized access. This can occur in installations using the legacy LDAP login handler or the TextFile login handler in combination with the standard legacy login handler. The estimated number of potentially affected devices is not provided.

Recommendations To resolve the issue, update to one of the resolving versions using Composer. As a temporary workaround, consider restricting access to the legacy login handler until the update is applied. Avoid using the legacy LDAP login handler or the TextFile login handler in combination with the standard legacy login handler until the issue is resolved.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

GHSA-P9MP-VQ4V-V5M5

Affected Products

Ez Publish Legacy

References · 8

• https://osv.dev/vulnerability/GHSA-p9mp-vq4v-v5m5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-10-31-1.yaml · Note
• https://github.com/ezsystems/ezpublish-legacy/commit/01930a95637389301f762be1439f726013e58aba · Note
• https://github.com/ezsystems/ezpublish-legacy/pull/1394 · Note
• https://github.com/ezsystems/ezpublish-legacy · Note
• https://web.archive.org/web/20210614184552/https://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users · Note
• https://web.archive.org/web/20201027063527/https://magento.com/security/news/new-zend-framework-1-security-vulnerability · Note
• https://issues.ibexa.co/browse/EZP-29703 · Note