Insecure Configuration

Affecting ezsystems/ezplatform package, versions >=1.13.0, <1.13.5.1 || >=2.5.0, <2.5.4 || >=1.7.0, <1.7.9.1

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

ezsystems/ezplatform is a fully open source professional CMS (Content Management System) developed by eZ Systems and the eZ Community.

Affected versions of this package are vulnerable to Insecure Configuration. The recommended Apache/Nginx virtual host configuration for eZ Platform includes a rewrite rule for blocking access to executable files in the var directory. This rule does not work when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service).

The consequence of this is that in such a setup, those executable files may be downloadable. They will not be executable, unless you have specifically configured platform.sh to allow that (which you really should not do). The severity of the download access is limited, but it's better if the platform.sh cloud setup works the same way as regular eZ Platform does. All platform.sh setups are affected.

Remediation

Upgrade ezsystems/ezplatform to version 1.13.5.1, 2.5.4, 1.7.9.1 or higher.

References

CVSS Score

4.3
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    Low
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    None
  • Availability
    None
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:R
Credit
Serhey Dolgushev
CWE
CWE-276
Snyk ID
SNYK-PHP-EZSYSTEMSEZPLATFORM-546868
Disclosed
06 Feb, 2020
Published
06 Feb, 2020