Packagist/ezsystems/ezplatform-admin-ui: critical
eZ Platform users with the Company admin role can assign any role to any user
Action: Upgrade ezsystems/ezplatform-admin-ui to 1.5.29 or later.
composer require ezsystems/ezplatform-admin-ui:1.5.29composer require ezsystems/ezplatform-admin-ui:2.3.26Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.5.0 | 1.5.29 | - |
| 2.3.0 | 2.3.26 | - |
Fixed versions
| 1.5.29 | 2.3.26 |
Sources
- osv: GHSA-pcpm-vc4v-cmvx
- https://github.com/ezsystems/ezplatform-admin-ui/security/advisories/GHSA-pcpm-vc4v-cmvx
- https://github.com/ezsystems/ezplatform-admin-ui/commit/29e156a7bbecca5abd946c99546a261679587d29
- https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips
- https://github.com/ezsystems/ezplatform-admin-ui
published · modified · JSON