{"action":"Upgrade ezsystems/ezplatform-rest to 1.3.8 or later.","affected":[{"fixed":"1.3.8","introduced":"1.3.0"}],"component":"ezsystems/ezplatform-rest","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["1.3.8"],"ghsa_id":"GHSA-36mj-6r7r-mqhf","id":"tcs_01M5KESPS2N1S6EDXA993MZPXV","modified_at":"2024-12-02T05:49:38.734493Z","published_at":"2021-09-29T17:09:23Z","references":["https://osv.dev/vulnerability/GHSA-36mj-6r7r-mqhf","https://github.com/ezsystems/ezplatform-rest/security/advisories/GHSA-36mj-6r7r-mqhf","https://developers.ibexa.co/security-advisories/ibexa-sa-2021-007-jwt-auth-possible-for-disabled-users.-username-login-handler-can-t-be-disabled","https://github.com/ezsystems/ezplatform-rest"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-36mj-6r7r-mqhf","url":"https://osv.dev/vulnerability/GHSA-36mj-6r7r-mqhf"}],"summary":"User can obtain JWT token even if account is disabled"}