CVE-2021-46876: 
PHP vulnerability analysis and mitigation

An issue was discovered in eZ Publish Ibexa Kernel before versions 6.13.8.1 and 7.5.15.1. The /user/sessions endpoint could be exploited to determine account existence, which was disclosed on March 9, 2021. This vulnerability affects eZ Platform v1.13, v2.5, v3.2, and Ibexa DXP and Ibexa Open Source v3.3 (Vendor Advisory).

The vulnerability allows attackers to detect if a given username or email refers to a valid account through differences in response data or response time of specific requests to the /user/sessions endpoint. The issue has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability could allow malicious actors to enumerate valid user accounts in the system, potentially facilitating further attacks such as brute force attempts or targeted phishing campaigns. This information disclosure vulnerability affects the confidentiality of user account information (Vendor Advisory).

The vulnerability has been fixed in versions 6.13.8.1 and 7.5.15.1 of eZ Publish Ibexa Kernel. Users should upgrade to these patched versions to prevent exploitation. The fix ensures that neither response data nor timing differences can be used to detect valid accounts (Vendor Advisory).