-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows the authorization credentials (user:pass) were removed from getIdentifier() and moved to getURL(). This indicates getIdentifier() was previously constructing a credential-containing string that might have been exposed in API responses. The vulnerability stems from sensitive data being included in an identifier that's part of external outputs, while the patched version limits credential handling to getURL() which is used for internal Solr communication.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform-solr-search-engine | composer | >= 3.3.0, < 3.3.15 | 3.3.15 |
| ezsystems/ezplatform-solr-search-engine | composer | >= 2.0.0, < 2.0.2 | 2.0.2 |
| ezsystems/ezplatform-solr-search-engine | composer | >= 1.7.0, < 1.7.12 | 1.7.12 |