-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezpublish-legacy | composer | >= 2018.9.0, < 2018.9.1.1 | 2018.9.1.1 |
| ezsystems/ezpublish-legacy | composer | >= 2018.6.0, < 2018.6.1.2 | 2018.6.1.2 |
| ezsystems/ezpublish-legacy | composer | >= 2011.0.0, < 2017.12.4.1 | 2017.12.4.1 |
| ezsystems/ezpublish-legacy | composer | >= 5.4.0, < 5.4.12.1 | 5.4.12.1 |
| ezsystems/ezpublish-legacy | composer | >= 5.3.0, < 5.3.12.4 | 5.3.12.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of PASSWORD_HASH_EMPTY (0) type users in authentication flow. The pre-patch code in authenticateHash() lacked checks for empty credentials and empty hash type, while createHash() contained fallback logic that could improperly process empty hash types. This allowed LDAP/TextFile users (with password_hash_type=0) to bypass password verification when combined with standard legacy login handler failures. The patch adds explicit checks in authenticateHash() and error handling in createHash() to prevent these scenarios.
Ongoing coverage of React2Shell