{"id":"GHSA-9wwx-c723-vm8x","summary":"eZ Platform REST API returns list of all SiteAccesses","details":"This security advisory fixes a vulnerability in eZ Platform, and we recommend that you install it as soon as possible. The issue is that the REST API may be made to disclose the names of all available site accesses. The severity of this depends on your installation, please consider your response accordingly.\n\nTo install, use Composer to update \"ezsystems/ezpublish-kernel\" to one of the \"Resolving versions\" mentioned above, or apply this patch manually:\nhttps://github.com/ezsystems/ezpublish-kernel/commit/1551723ec134878a4cb598bfc5d900ba6164117a","modified":"2024-11-29T05:35:46.897085Z","published":"2024-05-15T21:17:31Z","database_specific":{"cwe_ids":["CWE-200"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-05-15T21:17:31Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/ezsystems/ezpublish-kernel/commit/1551723ec134878a4cb598bfc5d900ba6164117a"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-kernel/2018-11-21-1.yaml"},{"type":"PACKAGE","url":"https://github.com/ezsystems/ezpublish-kernel"},{"type":"WEB","url":"https://web.archive.org/web/20210614181629/https://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses"},{"type":"WEB","url":"http://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses"}],"affected":[{"package":{"name":"ezsystems/ezpublish-kernel","ecosystem":"Packagist","purl":"pkg:composer/ezsystems/ezpublish-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.2.1"}]}],"versions":["v7.3.0","v7.3.1","v7.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-9wwx-c723-vm8x/GHSA-9wwx-c723-vm8x.json"}},{"package":{"name":"ezsystems/ezpublish-kernel","ecosystem":"Packagist","purl":"pkg:composer/ezsystems/ezpublish-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.4.1"}]}],"versions":["v7.0.0","v7.0.1","v7.0.2","v7.0.2.1","v7.0.2.2","v7.0.2.3","v7.1.0","v7.1.0-beta1","v7.1.0-beta2","v7.1.0-rc1","v7.1.0-rc2","v7.1.0.1","v7.1.0.2","v7.1.1","v7.1.1-rc1","v7.1.1.1","v7.2.0","v7.2.0-beta1","v7.2.0-rc1","v7.2.1","v7.2.2","v7.2.3","v7.2.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-9wwx-c723-vm8x/GHSA-9wwx-c723-vm8x.json"}},{"package":{"name":"ezsystems/ezpublish-kernel","ecosystem":"Packagist","purl":"pkg:composer/ezsystems/ezpublish-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.13.5.1"}]}],"versions":["v6.10.0","v6.10.0-beta1","v6.10.0-beta2","v6.10.0-beta3","v6.10.0-rc1","v6.10.0-rc2","v6.10.0-rc3","v6.10.1","v6.10.1-rc1","v6.11.0","v6.11.0-beta1","v6.11.0-rc1","v6.11.1","v6.11.2","v6.11.3","v6.11.4","v6.11.4.1","v6.12.0","v6.12.0-beta1","v6.12.0-beta2","v6.12.0-rc1","v6.12.0.1","v6.12.0.2","v6.12.1","v6.12.1-rc1","v6.12.1-rc2","v6.12.1-rc3","v6.12.1-rc4","v6.12.1.1","v6.13.0","v6.13.0-beta1","v6.13.0-beta2","v6.13.0-rc1","v6.13.0.1","v6.13.1","v6.13.1-rc1","v6.13.1.1","v6.13.1.2","v6.13.2","v6.13.2-beta1","v6.13.2-rc1","v6.13.3","v6.13.3-beta1","v6.13.3-rc1","v6.13.4","v6.13.4-beta1","v6.13.4-rc1","v6.13.5","v6.8.0","v6.8.1","v6.8.1-rc1","v6.9.0","v6.9.0-beta1","v6.9.0-rc1","v6.9.1","v6.9.1-rc1","v6.9.1-rc2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-9wwx-c723-vm8x/GHSA-9wwx-c723-vm8x.json"}},{"package":{"name":"ezsystems/ezpublish-kernel","ecosystem":"Packagist","purl":"pkg:composer/ezsystems/ezpublish-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.7.9.1"}]}],"versions":["v6.0.0","v6.0.0.1","v6.0.0.2","v6.0.1","v6.0.1.1","v6.0.1.2","v6.0.1.3","v6.0.1.4","v6.0.1.5","v6.0.1.6","v6.0.1.7","v6.1.0","v6.1.0-rc1","v6.1.1","v6.1.1.1","v6.2.0","v6.2.0-rc1","v6.2.0-rc2","v6.2.0-rc3","v6.2.0-rc4","v6.2.0-rc5","v6.2.1","v6.3.0","v6.3.0-beta1","v6.3.0-rc1","v6.3.0-rc2","v6.3.0-rc3","v6.3.1","v6.3.1-rc1","v6.3.2","v6.3.2-beta1","v6.3.2-beta2","v6.3.2-beta3","v6.3.2-rc1","v6.3.3","v6.3.3-rc1","v6.4.0","v6.4.0-beta1","v6.4.0-beta2","v6.4.0-rc1","v6.4.1","v6.4.1-rc1","v6.4.1-rc2","v6.4.2","v6.4.2-rc1","v6.5.0","v6.5.0-beta1","v6.5.0-rc1","v6.5.0-rc2","v6.5.0-rc3","v6.5.1","v6.5.1-rc1","v6.5.1.1","v6.5.2","v6.5.2-rc1","v6.5.2-rc2","v6.6.0","v6.6.0-beta1","v6.6.0-beta2","v6.6.0-rc1","v6.6.0-rc2","v6.6.1","v6.6.1-rc1","v6.6.1-rc2","v6.6.2","v6.6.2-rc1","v6.7.0","v6.7.0-beta1","v6.7.0-rc1","v6.7.0.1","v6.7.0.2","v6.7.0.3","v6.7.1","v6.7.1-rc1","v6.7.1-rc2","v6.7.2","v6.7.2-rc1","v6.7.3","v6.7.3-rc1","v6.7.4","v6.7.4-rc1","v6.7.4-rc2","v6.7.5","v6.7.5-rc1","v6.7.6","v6.7.6-rc1","v6.7.6.1","v6.7.6.2","v6.7.7","v6.7.7-beta1","v6.7.7-rc1","v6.7.7-rc2","v6.7.7.1","v6.7.8","v6.7.8-rc1","v6.7.8-rc2","v6.7.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-9wwx-c723-vm8x/GHSA-9wwx-c723-vm8x.json"}},{"package":{"name":"ezsystems/ezpublish-kernel","ecosystem":"Packagist","purl":"pkg:composer/ezsystems/ezpublish-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.13.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-9wwx-c723-vm8x/GHSA-9wwx-c723-vm8x.json"}},{"package":{"name":"ezsystems/ezpublish-kernel","ecosystem":"Packagist","purl":"pkg:composer/ezsystems/ezpublish-kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.12.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-9wwx-c723-vm8x/GHSA-9wwx-c723-vm8x.json"}}],"schema_version":"1.9.0"}