Privilege Escalation

ezsystems/ezplatform-kernel is vulnerable to privilege escalation. The vulnerability exists because the company role assigning feature is not properly handled which allows an attacker to limit the access of assigning roles to any user...

Privilege Escalation

ezsystems/repository-forms is vulnerable to privilege escalation. The vulnerability exists because the company role assigning function is not properly handled which allows an attacker to limit the access of assigning any roles to any user...

Timing Attacks

ezsystems/ezpublish-kernel is vulnerable to timing attacks. The vulnerability exists because the library does not compare hashes in constant time, allowing an attacker to progressively use the timing of the request to identify a valid hash...

Login timing attack in ezsystems/ezplatform-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

Previliage Escalation

ezsystems/ezpublish-kernel is vulnerable to privilege escalation. The vulnerability exists in evaluate function in ObjectStateLimitationType.php due to the weak permission which allows unauthorized user to elevate privileges...

Improper Certificate Validation in node-sass affects eZ Platform

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects...

GHSA-6V6P-G8CG-2HGG Improper Certificate Validation in node-sass affects eZ Platform

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects...

Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, sinc...

CVE-2022-25336

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference IDOR attacks against image files because the image path and filename can be correctly deduced...

CVE-2022-25337

The CVE-2022-25337 entry affects Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x before 7.5.26 and 1.3.x before 1.3.12, where image filename handling allows injection attacks. The connected sources confirm the vulnerability is tied to image filename sanitization issues, enabling injection thr...

Cross-Site Scripting (XSS)

ezsystems/ezplatform-richtext is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in custom tags allowing an attacker to inject and execute malicious javascript...

GHSA-9JP8-CWWX-P64Q XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...

GHSA-FXWM-RX68-P5VX XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...

GHSA-36MJ-6R7R-MQHF User can obtain JWT token even if account is disabled

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. Someone who never had an account cannot exploit this vulnerability. The fix ensures tokens are generated only for enabled...

User can obtain JWT token even if account is disabled

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. Someone who never had an account cannot exploit this vulnerability. The fix ensures tokens are generated only for enabled...

Information Disclosure

ezsystems/ezplatform-rest is vulnerable to information disclosure. The /user/sessions endpoint allows an attacker to discover valid accounts by analyzing the server response time...

Information Disclosure

ezsystems/ezpublish-kernel is vulnerable to Information Disclosure. The /user/sessions endpoint allows an attacker to detect if a given username or email refers to a valid account through the differences in the response data or response time of certain requests...