Read the docs
TI-2024-38651 Aliases GHSA-3g43-xfrw-pv5m

eZ Platform User data disclosure

Priority LOW 38CWE-200Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.

Summary

In eZ Platform v2.3.x it is possible to bypass permission checks in a particular case. This means user data such as name and email (but not passwords or password hashes) can be read by unauthenticated users. This affects only v2.3.x. If you use v2.2.x or older you are not affected. To install, use Composer to update "ezsystems/repository-forms" to the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/repository-forms/commit/ea82e136ec1ea40aca714abb79cc8e5bfece01e8 Have you found a security bug in eZ Publish or eZ Platform? See how to report it responsibly here: https://doc.ez.no/Security

Why it matters now

Fix Fixed ezsystems/repository-forms (Packagist): 2.3.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ezsystems/repository-forms (Packagist)2.3.0 to before 2.3.2.12.3.2.1Patch availableGHSA-3g43-xfrw-pv5m
  • ezsystems/repository-forms (Packagist) Vendor— Affected 2.3.0 to before 2.3.2.1 Fixed in 2.3.2.1 Patch available GHSA-3g43-xfrw-pv5m

Remediation

  • Fix · GHSA-3g43-xfrw-pv5m ezsystems/repository-forms (Packagist) Fixed in 2.3.2.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-3g43-xfrw-pv5m

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences