-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ibexa/user | composer | >= 5.0.0-beta1, < 5.0.4 | 5.0.4 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patch 9d485bf385e6401c9f7ee80287d8ccd00f73dcf4 reveals a flaw in the password change validation logic within the ibexa/user package. The vulnerability is located in the UserPasswordChangeData class constructor. Previously, the validation annotations for the old password were not being applied correctly, which resulted in the system not verifying the user's current password during a password change operation. The fix, which involves wrapping the NotBlank and UserPassword assertions within a Sequentially attribute, confirms that the constructor is the entry point for the vulnerable logic. Therefore, any runtime profile during an exploit of this vulnerability would show the Ibexa\User\Form\Data\UserPasswordChangeData::__construct function being called.
Ibexa\User\Form\Data\UserPasswordChangeData::__constructsrc/lib/Form/Data/UserPasswordChangeData.php
A Semantic Attack on Google Gemini - Read the Latest Research