-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the security patch reveals that the vulnerability is located in the UserPasswordChangeData.php file. The change from #[Assert\\NotBlank] to #[Assert\\Sequentially([...])] for the $oldPassword property within the __construct method indicates that the original validation was flawed. The #[Assert\\NotBlank] attribute likely prevented the UserAssert\\UserPassword validation from running, which is responsible for verifying the old password. The fix ensures both validations run sequentially. Therefore, the constructor of the UserPasswordChangeData class is the vulnerable function as it's responsible for setting up the incorrect validation logic.
Ibexa\User\Form\Data\UserPasswordChangeData::__constructsrc/lib/Form/Data/UserPasswordChangeData.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ibexa/user | composer | >= 5.0.0-beta1, < 5.0.4 | 5.0.4 |
A Semantic Attack on Google Gemini - Read the Latest Research