PT-2024-40535 · Ez Systems · Ez-Support-Tools

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: ezsystems/ez-support-tools version 2.2

Description: The issue allows a user with insufficient permissions to access system information tabs by directly typing in the link, despite the link not being shown in the menu. Normally, the "Setup / System info" policy should be required for access, but currently, only a backend login is needed. This means any editor can view core system information, including phpinfo() output.

Recommendations: For ezsystems/ez-support-tools version 2.2, ensure that the access policy is correctly verified to restrict access to the system information tabs, requiring the "Setup / System info" policy as intended.

Related Identifiers

GHSA-XMP3-7745-G4VJ

Affected Products

Ez-Support-Tools

References · 4

• https://osv.dev/vulnerability/GHSA-xmp3-7745-g4vj · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ez-support-tools/2020-12-01-1.yaml · Note
• https://github.com/ezsystems/ez-support-tools · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2020-007-failing-access-control-in-system-info-view · Note