-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the GraphQL schema definition in User.types.yaml explicitly including the passwordHash field. This configuration-level exposure allows unauthenticated queries to access sensitive user data. The workaround directly references removing passwordHash from this specific file, and the advisory mentions patched versions modify schema definitions. While no specific PHP functions are named, the schema configuration itself acts as the vulnerable component by exposing protected fields through the GraphQL API without authorization checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform-graphql | composer | >= 1.0.0-rc1, < 1.0.13 | 1.0.13 |
| ezsystems/ezplatform-graphql | composer | >= 2.0.0-beta1, < 2.3.12 | 2.3.12 |
KEV Misses 88% of Exploited CVEs- Get the report