Download route allows filename change in ezsystems/ezplatform-kernel
Summary
GHSA-gv2c-5g79-h73c: Ibexa ezplatform-kernel download route allows filename change. Affects ezsystems/ezplatform-kernel versions >= 1.3.0, < 1.3.34. Fixed in 1.3.34. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ezsystems/ezplatform-kernel is a package in the Packagist ecosystem that is used in installations of Ibexa DXP and eZ Platform. It provides the kernel functionality for these platforms, including handling file downloads. This package is widely used and allows users to download files from the system.
Vulnerability Detail
The download route in ezsystems/ezplatform-kernel allows users to specify the name of the downloaded file. This unintended side effect can lead to confusion and misunderstandings, as users can construct download URLs with filenames that have no relation to the actual file. While this vulnerability has a low severity, it can potentially cause harm in certain scenarios. This vulnerability affects all supported versions of Ibexa DXP and eZ Platform where downloadable files exist.
How To Fix
Minimum fixed version
1.3.34
This is the first release that contains the fix.
composer require ezsystems/ezplatform-kernel:1.3.34Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability other than blocking all downloads, which may not be feasible in most cases.
Conclusion
In conclusion, the download route in ezsystems/ezplatform-kernel allows users to specify the name of the downloaded file, which can lead to confusion and misunderstandings. While this vulnerability has a low severity, it is recommended to update to the latest patched version of ezsystems/ezplatform-kernel to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ezsystems/ezplatform-kernel →
FAQ
The impact of this vulnerability is low, but it can lead to confusion and misunderstandings as users can download files with unrelated filenames.
All supported versions of ezsystems/ezplatform-kernel are affected.
There are no known exploits for this vulnerability at the moment.
Yes, the issue has been fixed in all supported versions of ezsystems/ezplatform-kernel. It is recommended to update to the latest patched version.
Yes, you can mitigate this vulnerability by updating to the latest patched version of ezsystems/ezplatform-kernel.
Related vulnerabilities
Recent vulnerabilities recorded for ezsystems/ezplatform-kernel.
