Packagist/ezsystems/ezplatform-kernel: critical
eZ Platform users with the Company admin role can assign any role to any user
Action: Upgrade ezsystems/ezplatform-kernel to 1.3.26 or later.
composer require ezsystems/ezplatform-kernel:1.3.26Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 1.3.26 | - |
Fixed versions
| 1.3.26 |
Sources
- osv: GHSA-8h83-chh2-fchp
- https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp
- https://github.com/ezsystems/ezplatform-kernel/commit/2a7479958584a15ee046dfa886d6bfeb4ebfa2f6
- https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips
- https://github.com/ezsystems/ezplatform-kernel
published · modified · JSON