GHSA-7vwg-39h8-8qp8
/user/sessions endpoint allows detecting valid accounts
GHSA-7vwg-39h8-8qp8 is a vulnerability with no CVSS score yet in ezsystems/ezplatform-rest, published March 11, 2021. No source lists public exploit code. Fixed in ezsystems/ezplatform-rest 1.2.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.2.1ezsystems/ezplatform-rest +3 more
Description
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.
If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezplatform-restPackagist | 1.2.0 to 1.2.2.0 | 1.2.2.1 |
ezsystems/ezplatform-restPackagist | 1.3.0 to 1.3.1.0 | 1.3.1.1 |
ezsystems/ezplatform-restPackagist | 1.2.0 up to 1.2.2.1, plus listed versions v1.2.0v1.2.1v1.2.2 | 1.2.2.1 |
ezsystems/ezplatform-restPackagist | 1.3.0 up to 1.3.1.1, plus listed versions v1.3.0v1.3.1 | 1.3.1.1 |
What each source reports
GitHub AdvisoriesNo score
/user/sessions endpoint allows detecting valid accounts
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.
If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
- Record
GHSA-7vwg-39h8-8qp8- Weakness
- CWE-203
- Updated
- 2026-11-02
OSVNo score
/user/sessions endpoint allows detecting valid accounts
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.
If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
- Record
GHSA-7vwg-39h8-8qp8- Weakness
- CWE-203
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.