Skip to content
Fencer Intel
high —

GHSA-45qm-j4m9-whv9 json

eZ Platform CSRF token in login form is disabled by default

published 2y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released.

If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this: ``` security: firewalls: ezpublish_front: form_login: csrf_token_generator: security.csrf.token_manager ``` NB: In eZ Platform 3.0 this file has been moved to config/packages/security.yaml

Patch / fix

  • packagist ezsystems/ezplatform 2.5.4

Is GHSA-45qm-j4m9-whv9 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist ezsystems/ezplatform
>=2.5.0, <2.5.4
2.5.4

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.