Description
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | ezsystems/ezpublish-kernel | >= 6.13.0, < 6.13.8.1 | 6.13.8.1 | GHSA-gmrf-99gw-vvwj |
| Packagist | ezsystems/ezpublish-kernel | >= 7.5.0, < 7.5.15.1 | 7.5.15.1 | GHSA-gmrf-99gw-vvwj |