eZ Platform User Data Disclosure Vulnerability in ezsystems/repository-forms
Summary
GHSA-3g43-xfrw-pv5m: eZ Platform User data disclosure. Affects ezsystems/repository-forms versions >= 2.3.0, < 2.3.2.1. Fixed in 2.3.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ezsystems/repository-forms is a package available on Packagist that is used in eZ Platform, a content management system. It provides functionality related to repository forms. The package is vulnerable to a user data disclosure issue in version 2.3.x of eZ Platform. This vulnerability allows unauthenticated users to bypass permission checks and access user data such as name and email. However, sensitive information like passwords or password hashes are not exposed. Versions 2.2.x and older are not affected by this vulnerability.
Vulnerability Detail
The user data disclosure vulnerability in ezsystems/repository-forms affects eZ Platform version 2.3.x. It allows unauthenticated users to read user data, including names and emails. This can lead to potential privacy breaches and unauthorized access to personal information. The vulnerability arises from a bypass of permission checks in a specific scenario. It is important to note that passwords and password hashes are not exposed. The issue has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
2.3.2.1
This is the first release that contains the fix.
composer require ezsystems/repository-forms:2.3.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The user data disclosure vulnerability in ezsystems/repository-forms can lead to unauthorized access to user information. It is crucial to update the package to version 2.3.2.1 or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ezsystems/repository-forms →
FAQ
Only version 2.3.x of eZ Platform is affected. Versions 2.2.x and older are not vulnerable.
Unauthenticated users can access user data such as names and emails. However, sensitive information like passwords or password hashes are not exposed.
Yes, a manual patch is available for this vulnerability. You can find the patch at the following URL: https://github.com/ezsystems/repository-forms/commit/ea82e136ec1ea40aca714abb79cc8e5bfece01e8.
This vulnerability has been assigned a severity rating of HIGH.
No specific workarounds are mentioned for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for ezsystems/repository-forms.
