Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-pa5n-n8xz-k7e3
Summary
eZ Platform User data disclosure
In eZ Platform v2.3.x it is possible to bypass permission checks in a particular case. This means user data such as name and email (but not passwords or password hashes) can be read by unauthenticated users. This affects only v2.3.x. If you use v2.2.x or older you are not affected.

To install, use Composer to update "ezsystems/repository-forms" to the "Resolving versions" mentioned above, or apply this patch manually:
https://github.com/ezsystems/repository-forms/commit/ea82e136ec1ea40aca714abb79cc8e5bfece01e8

Have you found a security bug in eZ Publish or eZ Platform? See how to report it responsibly here: https://doc.ez.no/Security
Aliases
0
alias GHSA-3g43-xfrw-pv5m
Fixed_packages
0
url pkg:composer/ezsystems/repository-forms@2.3.2.1
purl pkg:composer/ezsystems/repository-forms@2.3.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/repository-forms@2.3.2.1
Affected_packages
0
url pkg:composer/ezsystems/repository-forms@2.3.0
purl pkg:composer/ezsystems/repository-forms@2.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-pa5n-n8xz-k7e3
1
vulnerability VCID-z2cq-sqav-4ybd
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/repository-forms@2.3.0
1
url pkg:composer/ezsystems/repository-forms@2.3.1
purl pkg:composer/ezsystems/repository-forms@2.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-pa5n-n8xz-k7e3
1
vulnerability VCID-z2cq-sqav-4ybd
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/repository-forms@2.3.1
2
url pkg:composer/ezsystems/repository-forms@2.3.2
purl pkg:composer/ezsystems/repository-forms@2.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-pa5n-n8xz-k7e3
1
vulnerability VCID-z2cq-sqav-4ybd
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/repository-forms@2.3.2
References
0
reference_url https://github.com/ezsystems/repository-forms
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/ezsystems/repository-forms
1
reference_url https://github.com/ezsystems/repository-forms/commit/ea82e136ec1ea40aca714abb79cc8e5bfece01e8
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/ezsystems/repository-forms/commit/ea82e136ec1ea40aca714abb79cc8e5bfece01e8
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/repository-forms/2018-11-20-1.yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/repository-forms/2018-11-20-1.yaml
3
reference_url http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure
4
reference_url https://web.archive.org/web/20210614184249/http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210614184249/http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure
5
reference_url https://github.com/advisories/GHSA-3g43-xfrw-pv5m
reference_id GHSA-3g43-xfrw-pv5m
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3g43-xfrw-pv5m
Weaknesses
0
cwe_id 200
name Exposure of Sensitive Information to an Unauthorized Actor
description The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score7.0 - 8.9
Exploitability0.5
Weighted_severity8.0
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-pa5n-n8xz-k7e3