Every CVESearch/Get API key

GHSA-45qm-j4m9-whv9

eZ Platform CSRF token in login form is disabled by default

No scoreFix available

GHSA-45qm-j4m9-whv9 is a vulnerability with no CVSS score yet in ezsystems/ezplatform, published May 15, 2024. No source lists public exploit code. Fixed in ezsystems/ezplatform 2.5.4.

What does this mean?
Severity
UnratedNo CVSS score yet
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.5.4ezsystems/ezplatform +1 more

Description

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released.

If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this:

security:
    firewalls:
        ezpublish_front:
            form_login:
                csrf_token_generator: security.csrf.token_manager

NB: In eZ Platform 3.0 this file has been moved to config/packages/security.yaml

Affected packages

Affected packages
PackageAffectedFixed
ezsystems/ezplatform
Packagist
2.5.0 up to 2.5.4
2.5.4
ezsystems/ezplatform
Packagist
2.5.0 up to 2.5.4, plus listed versions
v2.5.0v2.5.1v2.5.2v2.5.3
2.5.4

What each source reports

GitHub AdvisoriesNo score

eZ Platform CSRF token in login form is disabled by default

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released.

If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this:

security:
    firewalls:
        ezpublish_front:
            form_login:
                csrf_token_generator: security.csrf.token_manager

NB: In eZ Platform 3.0 this file has been moved to config/packages/security.yaml

Record
GHSA-45qm-j4m9-whv9
Weakness
CWE-352
Updated
2026-11-02
OSVNo score

eZ Platform CSRF token in login form is disabled by default

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released.

If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this:

security:
    firewalls:
        ezpublish_front:
            form_login:
                csrf_token_generator: security.csrf.token_manager

NB: In eZ Platform 3.0 this file has been moved to config/packages/security.yaml

Record
GHSA-45qm-j4m9-whv9
Weakness
CWE-352
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open