p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in ezsystems/ezplatform

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für ezsystems/ezplatform: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 4

  1. GHSA-qhjc-hg94-245v

    Nicht bewertetKorrektur verfügbar

    eZ Platform Prevent accepting app.php in URL in Platform.sh

    The recommended rewrite rules in eZ Platform prevent users from including the front-controller script (normally "app.php") in URLs. This prevents certain vulnerabilities related to caching. However, this is not possible when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service), nor can it be done within the .platform.app.yaml configuration file. Therefore we need to reject such requests in the application itself. This advisory adds the prevention within the front controller script itself. If you use eZ Platform Cloud / Platform.sh we recommend that you install this security update as soon as possible. It is di

    ezsystems/ezplatform ezsystems/ezplatform ezsystems/ezplatformPHP
    • Auf 1.13.5.1 aktualisieren
    • Auf 1.7.9.1 aktualisieren
    • Auf 2.5.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. GHSA-6xch-2vxx-5pvr

    Nicht bewertetKorrektur verfügbar

    eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)

    The recommended Apache/Nginx virtual host configuration for eZ Platform includes a rewrite rule for blocking access to executable files in the var directory. This rule does not work when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service). The consequence of this is that in such a setup, those executable files may be downloadable. They will not be executable, unless you have specifically configured platform.sh to allow that (which you really should not do). The severity of the download access is limited, but it's better if the platform.sh cloud setup works the same way as regular eZ Platform does. All platfor

    ezsystems/ezplatform ezsystems/ezplatform ezsystems/ezplatformPHP
    • Auf 1.13.5.1 aktualisieren
    • Auf 1.7.9.1 aktualisieren
    • Auf 2.5.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. GHSA-45qm-j4m9-whv9

    Nicht bewertetKorrektur verfügbar

    eZ Platform CSRF token in login form is disabled by default

    his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released. If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this: ``` security: firewalls: ezpublish_front: form_login: csrf_token_genera

    ezsystems/ezplatformPHP
    • Auf 2.5.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. GHSA-2rh5-jvgx-pgw3

    Nicht bewertetKorrektur verfügbar

    Any storage file can be downloaded from p.sh if full server path is known

    The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.

    ezsystems/ezplatform ezsystems/ezplatformPHP
    • Auf 1.13.6.1 aktualisieren
    • Auf 2.5.24.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →