-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform | composer | >= 2.5.0, < 2.5.4 | 2.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from a configuration setting rather than specific code functions. The CSRF protection in Symfony's form_login component requires explicit enabling via 'csrf_token_generator' configuration. While Symfony's underlying CSRF validation functions (e.g., CsrfTokenManager) exist, they weren't being invoked due to the missing configuration. No specific functions in eZ Platform's codebase are inherently vulnerable - the exposure comes from security controls being disabled by default in the YAML configuration files, not from flawed function implementations.