Authentication Bypass Affecting ezsystems/ezpublish-legacy package, versions >=5.4.0, <5.4.12.1 >=2017.12.0, <2017.12.4.1 >=5.3.0, <5.3.12.4 >=2018.6.0, <2018.6.1.2 >=2018.9.0, <2018.9.1.1
Snyk CVSS
Attack Complexity
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-EZSYSTEMSEZPUBLISHLEGACY-72554
- published 4 Nov 2018
- disclosed 5 Oct 2018
- credit Unknown
How to fix?
Upgrade ezsystems/ezpublish-legacy
to versions 5.3.12.4, 5.4.12.1, 2017.12.4.1, 2018.06.1.2, 2018.09.1.1 or higher.
Overview
ezsystems/ezpublish-legacy is a PHP application framework with advanced CMS (content management system) functionality.
Affected versions of this package are vulnerable to Authentication Bypass. Installations that are using the legacy LDAP
login handler or the TextFile
login handler in combination with the standard legacy login handler, may in fail to verify passwords correctly, allowing unauthorised access.