eZ Publish Legacy Passwordless login for LDAP users
This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy.
Installations that are using the legacy LDAP login handler or the TextFile login handler in combination with the standard legacy login handler, may in rare cases be vulnerable to a failure of the standard login handler to verify passwords correctly, allowing unauthorised access.
If your installation has never used the LDAP or TextFile login handlers, or never used legacy login at all, then it is not affected. Still, we recommend installing the update, to be on the safe side.
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/13f03a2be6c0ee4d0caaafaef05904ea9b0c4d9d
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ezsystems/ezpublish-legacy | >= 2018.9.0, < 2018.9.1.1, >= 2018.6.0, < 2018.6.1.2, >= 2011.0.0, < 2017.12.4.1, >= 5.4.0, < 5.4.12.1, >= 5.3.0, < 5.3.12.4 | 2018.9.1.1, 2018.6.1.2, 2017.12.4.1, 5.4.12.1, 5.3.12.4 |
References
- https://github.com/ezsystems/ezpublish-legacy/pull/1394
- https://github.com/ezsystems/ezpublish-legacy/commit/01930a95637389301f762be1439f726013e58aba
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-10-31-1.yaml
- https://github.com/ezsystems/ezpublish-legacy
- https://issues.ibexa.co/browse/EZP-29703
- https://web.archive.org/web/20201027063527/https://magento.com/security/news/new-zend-framework-1-security-vulnerability
- https://web.archive.org/web/20210614184552/https://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users
- Weakness (CWE)
CWE-285- Platform
- Composer
- Package
ezsystems/ezpublish-legacy- Disclosed
- 15.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-p9mp-vq4v-v5m5 - CC BY 4.0
Vulnerability history: ezsystems/ezpublish-legacy
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 09.2021 05.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 6
- Medium 4
Disclosures per year
- 2021: 1
- 2022: 2
- 2023: 0
- 2024: 7
- 2025: 0
- 2026: 1
-
eZ Publish Legacy Passwordless login for LDAP users this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.