eZ Publish Legacy Passwordless login for LDAP users
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-285.
Summary
This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy. Installations that are using the legacy LDAP login handler or the TextFile login handler in combination with the standard legacy login handler, may in rare cases be vulnerable to a failure of the standard login handler to verify passwords correctly, allowing unauthorised access. If your installation has never used the LDAP or TextFile login handlers, or never used legacy login at all, then it is not affected. Still, we recommend installing the update, to be on the safe side. To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/13f03a2be6c0ee4d0caaafaef05904ea9b0c4d9d
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ezsystems/ezpublish-legacy (Packagist) | 2018.9.0 to before 2018.9.1.1 | 2018.9.1.1 | Patch available | GHSA-p9mp-vq4v-v5m5 |
| — | ezsystems/ezpublish-legacy (Packagist) | 2018.6.0 to before 2018.6.1.2 | 2018.6.1.2 | Patch available | GHSA-p9mp-vq4v-v5m5 |
| — | ezsystems/ezpublish-legacy (Packagist) | 2011.0.0 to before 2017.12.4.1 | 2017.12.4.1 | Patch available | GHSA-p9mp-vq4v-v5m5 |
| — | ezsystems/ezpublish-legacy (Packagist) | 5.4.0 to before 5.4.12.1 | 5.4.12.1 | Patch available | GHSA-p9mp-vq4v-v5m5 |
| — | ezsystems/ezpublish-legacy (Packagist) | 5.3.0 to before 5.3.12.4 | 5.3.12.4 | Patch available | GHSA-p9mp-vq4v-v5m5 |
- ezsystems/ezpublish-legacy (Packagist) Vendor— Affected 2018.9.0 to before 2018.9.1.1 Fixed in 2018.9.1.1 Patch available GHSA-p9mp-vq4v-v5m5
- ezsystems/ezpublish-legacy (Packagist) Vendor— Affected 2018.6.0 to before 2018.6.1.2 Fixed in 2018.6.1.2 Patch available GHSA-p9mp-vq4v-v5m5
- ezsystems/ezpublish-legacy (Packagist) Vendor— Affected 2011.0.0 to before 2017.12.4.1 Fixed in 2017.12.4.1 Patch available GHSA-p9mp-vq4v-v5m5
- ezsystems/ezpublish-legacy (Packagist) Vendor— Affected 5.4.0 to before 5.4.12.1 Fixed in 5.4.12.1 Patch available GHSA-p9mp-vq4v-v5m5
- ezsystems/ezpublish-legacy (Packagist) Vendor— Affected 5.3.0 to before 5.3.12.4 Fixed in 5.3.12.4 Patch available GHSA-p9mp-vq4v-v5m5
Remediation
- Fix · GHSA-p9mp-vq4v-v5m5 ezsystems/ezpublish-legacy (Packagist) Fixed in 2018.9.1.1 Advisory →
- Fix · GHSA-p9mp-vq4v-v5m5 ezsystems/ezpublish-legacy (Packagist) Fixed in 2018.6.1.2 Advisory →
- Fix · GHSA-p9mp-vq4v-v5m5 ezsystems/ezpublish-legacy (Packagist) Fixed in 2017.12.4.1 Advisory →
- Fix · GHSA-p9mp-vq4v-v5m5 ezsystems/ezpublish-legacy (Packagist) Fixed in 5.4.12.1 Advisory →
- Fix · GHSA-p9mp-vq4v-v5m5 ezsystems/ezpublish-legacy (Packagist) Fixed in 5.3.12.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-p9mp-vq4v-v5m5
References
Other 7
- https://github.com/ezsystems/ezpublish-legacy/pull/1394
- https://github.com/ezsystems/ezpublish-legacy/commit/01930a95637389301f762be1439f726013e58aba
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-10-31-1.yaml
- https://github.com/ezsystems/ezpublish-legacy
- https://issues.ibexa.co/browse/EZP-29703
- https://web.archive.org/web/20201027063527/https://magento.com/security/news/new-zend-framework-1-security-vulnerability
- https://web.archive.org/web/20210614184552/https://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences