GHSA-cg84-55jx-4237: Ezsystems/ezplatform admin ui EZ Platform Password Reset Vulnerability Vulnerability
HIGHGHSA-cg84-55jx-4237 is a HIGH ez platform password reset vulnerability vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) affecting Ezsystems/ezplatform admin ui libraries in the Packagist ecosystem. The issue involves ez platform password reset vulnerability. Remediation is available by upgrading affected packages to version 1.4.6.
GHSA-cg84-55jx-4237 at a Glance
How to Fix GHSA-cg84-55jx-4237
To remediate this vulnerability, upgrade all affected Ezsystems/ezplatform admin ui dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade ezsystems/ezplatform-admin-ui to 1.4.6Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for ezsystems/ezplatform-admin-uiHow to Check if You Are Affected
To determine whether your application is affected by GHSA-cg84-55jx-4237, inspect your project dependencies for Ezsystems/ezplatform admin ui:
inspect dependencies for ezsystems/ezplatform-admin-uiAnalyze the terminal output to locate any version of Ezsystems/ezplatform admin ui in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.6), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-307: Improper Restriction of Excessive Authentication Attempts, where the product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. In Ezsystems/ezplatform admin ui, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-cg84-55jx-4237 Affected Ezsystems/ezplatform admin ui Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
ezsystems/ezplatform-admin-ui
|
Packagist |
≥ 1.4.0
< 1.4.6
|
1.4.6
|
References
Frequently Asked Questions
What is GHSA-cg84-55jx-4237?
Which Ezsystems/ezplatform admin ui versions are affected?
What version fixes GHSA-cg84-55jx-4237?
Is ezsystems/ezplatform-admin-ui affected?
What CWE is associated with GHSA-cg84-55jx-4237?
How can I check Packagist dependencies for GHSA-cg84-55jx-4237?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-cg84-55jx-4237",
"modified" : "2024-05-15T21:12:59Z",
"published" : "2024-05-15T21:12:59Z",
"aliases" : [ ],
"summary" : "eZ Platform Password reset vulnerability",
"details" : "This Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x.\n \nThe functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other circumstances an attacker may exploit this to gain control over user accounts. The update ensures such an attack is exceedingly unlikely to succeed.\n \nYou may want to consider a configuration change to further strengthen your security. By default a password reset request is valid for 1 hour. Reducing this time will make attacks even more difficult, but ensure there is enough time left to account for email delivery delays, and user delays. See documentation at https://doc.ezplatform.com/en/latest/guide/user_management/#changing-and-recovering-passwords\n\nTo install, use Composer to update to one of the \"Resolving versions\" mentioned above. If you use eZ Platform 2.5, update ezsystems/ezplatform-user to v1.0.1. If you use eZ Platform 2.4, update ezsystems/ezplatform-admin-ui to v1.4.6, and ezsystems/ezplatform-admin-ui-modules to v1.4.4, and ezsystems/repository-forms to v2.4.5)",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "ezsystems/ezplatform-admin-ui"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.4.0"
}, {
"fixed" : "1.4.6"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-admin-ui/2019-04-03-1.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/ezsystems/ezplatform-admin-ui"
}, {
"type" : "WEB",
"url" : "https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability"
}, {
"type" : "WEB",
"url" : "https://web.archive.org/web/20210615002251/https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-307" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-05-15T21:12:59Z",
"nvd_published_at" : null
}
}