Skip to content
OpenAdvisories

Package · Packagist

ezsystems/ezplatform-rest

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-36mj-6r7r-mqhf

    User can obtain JWT token even if account is disabled

    Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. (Someone who never had an account cannot exploit this vulnerability.) The fix ensure…

    ezsystems/ezplatform-rest Packagist
  • High —
    GHSA-7vwg-39h8-8qp8

    /user/sessions endpoint allows detecting valid accounts

    This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detec…

    ezsystems/ezplatform-rest Packagist