PT-2024-40432 · Ez Systems · Ez Platform

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ezsystems/ezplatform versions 1.7.9 through 1.7.9, 1.13.5 through 1.13.5, 2.5.4 through 2.5.4

Description The issue is related to caching vulnerabilities when the front-controller script is included in URLs. This is particularly problematic when using eZ Platform Cloud, as the recommended rewrite rules cannot be applied. To mitigate this, the advisory introduces a prevention mechanism within the front controller script itself.

Recommendations For versions 1.7.9, 1.13.5, and 2.5.4, install the security update distributed via Composer as ezsystems/ezplatform 1.7.9.1, 1.13.5.1, and 2.5.4 respectively.

Related Identifiers

GHSA-QHJC-HG94-245V

Affected Products

Ez Platform

References · 5

• https://osv.dev/vulnerability/GHSA-qhjc-hg94-245v · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform/2019-09-03-2.yaml · Note
• https://github.com/ezsystems/ezplatform/commit/34ce86722b36a172e587068fe64a84faa7320cc2 · Note
• https://github.com/ezsystems/ezplatform · Note
• https://share.ez.no/community-project/security-advisories/ezsa-2019-007-prevent-accepting-app.php-in-url-in-platform.sh · Note