Read the docs
TI-2021-22617 Aliases GHSA-7vwg-39h8-8qp8

/user/sessions endpoint allows detecting valid accounts

Priority LOW 38CWE-203Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-203.

Summary

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer. If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc

Why it matters now

Fix Fixed ezsystems/ezplatform-rest (Packagist): 1.2.2.1, 1.3.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ezsystems/ezplatform-rest (Packagist)1.2.0 to before 1.2.2.11.2.2.1Patch availableGHSA-7vwg-39h8-8qp8
—ezsystems/ezplatform-rest (Packagist)1.3.0 to before 1.3.1.11.3.1.1Patch availableGHSA-7vwg-39h8-8qp8
  • ezsystems/ezplatform-rest (Packagist) Vendor— Affected 1.2.0 to before 1.2.2.1 Fixed in 1.2.2.1 Patch available GHSA-7vwg-39h8-8qp8
  • ezsystems/ezplatform-rest (Packagist) Vendor— Affected 1.3.0 to before 1.3.1.1 Fixed in 1.3.1.1 Patch available GHSA-7vwg-39h8-8qp8

Remediation

  • Fix · GHSA-7vwg-39h8-8qp8 ezsystems/ezplatform-rest (Packagist) Fixed in 1.2.2.1 Advisory →
  • Fix · GHSA-7vwg-39h8-8qp8 ezsystems/ezplatform-rest (Packagist) Fixed in 1.3.1.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7vwg-39h8-8qp8

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences