GHSA-9wwx-c723-vm8x:
eZ Platform REST API returns list of all SiteAccesses
N/A
CVSS Score
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
Published
5/15/2024
Updated
5/15/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
-
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezpublish-kernel | composer | >= 7.3.0, < 7.3.2.1 | 7.3.2.1 |
| ezsystems/ezpublish-kernel | composer | >= 7.0.0, < 7.2.4.1 | 7.2.4.1 |
| ezsystems/ezpublish-kernel | composer | >= 6.8.0, < 6.13.5.1 | 6.13.5.1 |
| ezsystems/ezpublish-kernel | composer | >= 6.0.0, < 6.7.9.1 | 6.7.9.1 |
| ezsystems/ezpublish-kernel | composer | >= 5.4.0, < 5.4.13.1 | 5.4.13.1 |
| ezsystems/ezpublish-kernel | composer | >= 5.3.0, < 5.3.12.1 | 5.3.12.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from error messages disclosing all SiteAccess names when invalid input is provided. The patch introduces a debug flag to conditionally include this sensitive information. The core issue occurs in the exception-throwing functions:
- Router::match() handles X-Siteaccess header validation and previously always included the SiteAccess list in error messages.
- ConsoleCommandListener::onConsoleCommand() performed similar disclosure for CLI commands. Both functions passed the full SiteAccess list to InvalidSiteAccessException constructor without debug checks prior to the patch, making them the direct sources of information leakage.