GHSA-9wwx-c723-vm8x eZ Platform REST API returns list of all SiteAccesses
Unauthenticated attackers can retrieve a list of all SiteAccess names via the REST API, exposing internal configuration details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-9wwx-c723-vm8x?
GHSA-9wwx-c723-vm8x is a vulnerability in ezsystems/ezpublish-kernel, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This security advisory fixes a vulnerability in eZ Platform, and we recommend that you install it as soon as possible. The issue is that the REST API may be made to disclose the names of all available site accesses. The severity of this depends on your installation, please consider your response accordingly.
To install, use Composer to update "ezsystems/ezpublish-kernel" to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-kernel/commit/1551723ec134878a4cb598bfc5d900ba6164117a
Which versions are affected by GHSA-9wwx-c723-vm8x?
12 open source packages ship an affected version, including ezsystems/ezpublish-kernel.
| Package | Affected | Fixed in |
|---|---|---|
ezsystems/ezpublish-kernel Packagist | From 5.3.0 | 5.3.12.1 |
ezsystems/ezpublish-kernel Packagist | From 5.3.0 | 5.3.12.1 |
ezsystems/ezpublish-kernel Packagist | From 5.4.0 | 5.4.13.1 |
ezsystems/ezpublish-kernel Packagist | From 5.4.0 | 5.4.13.1 |
ezsystems/ezpublish-kernel Packagist | From 6.0.0 | 6.7.9.1 |
ezsystems/ezpublish-kernel Packagist | From 6.0.0 | 6.7.9.1 |
6 more packages
ezsystems/ezpublish-kernel Packagist | From 6.8.0 | 6.13.5.1 |
ezsystems/ezpublish-kernel Packagist | From 6.8.0 | 6.13.5.1 |
ezsystems/ezpublish-kernel Packagist | From 7.0.0 | 7.2.4.1 |
ezsystems/ezpublish-kernel Packagist | From 7.0.0 | 7.2.4.1 |
ezsystems/ezpublish-kernel Packagist | From 7.3.0 | 7.3.2.1 |
ezsystems/ezpublish-kernel Packagist | From 7.3.0 | 7.3.2.1 |
How do I fix GHSA-9wwx-c723-vm8x?
Upgrade ezsystems/ezpublish-kernel to a fixed version for your release line: 5.3.12.1, 5.4.13.1, 6.7.9.1 or 6.13.5.1.
Is GHSA-9wwx-c723-vm8x being exploited?
There is no known exploitation of GHSA-9wwx-c723-vm8x in the wild and no public exploit code.