Skip to content
Fencer Intel
low —

GHSA-g95c-xc83-8353 json

Ibexa DXP Download route allows filename change

published 3y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and confusion, and possibly other harm. As such it is a low severity vulnerability. It affects all supported versions of Ibexa DXP and eZ Platform, in installations where downloadable files exist.

### Patches The issue is fixed in all supported versions of ibexa/core, see "Patched versions". An advisory is also published for ezsystems/ezpublish-kernel and ezsystems/ezplatform-kernel, please see those repositories. Commit: https://github.com/ibexa/core/commit/704f221031ea4e32bd5510fe4c1fa8e0f664cbd4

### Workarounds None, other than blocking all downloads.

### References https://developers.ibexa.co/security-advisories/ibexa-sa-2023-005-vulnerabilities-in-solr-search-and-file-downloads

Patch / fix

  • packagist ibexa/core 4.5.4

Is GHSA-g95c-xc83-8353 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist ibexa/core
>=4.5.0, <4.5.4
4.5.4

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.