Timing Attack Affecting ezsystems/ezpublish-kernel package, versions >=7.5.0, <7.5.15.1 >=6.13.0, <6.13.8.1
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.07% (30th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-EZSYSTEMSEZPUBLISHKERNEL-1085280
- published 12 Mar 2021
- disclosed 11 Mar 2021
- credit Unknown
Introduced: 11 Mar 2021
CVE-2021-46876 Open this link in a new tabHow to fix?
Upgrade ezsystems/ezpublish-kernel to version 7.5.15.1, 6.13.8.1 or higher.
Overview
ezsystems/ezpublish-kernel is a kernel used by ezsystems/ezplatform and derivatives. Provides the Content Repository, its APIs, and the application's Symfony framework integration.
Affected versions of this package are vulnerable to Timing Attack. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests.