GHSA-3g43-xfrw-pv5m: 
PHP vulnerability analysis and mitigation

EZSA-2018-007 is a high severity vulnerability affecting eZ Platform's repository-forms component versions 2.3.x, discovered and disclosed on November 20, 2018. The vulnerability affects the ezsystems/repository-forms package, specifically versions greater than or equal to 2.3.0 and less than 2.3.2.1. Earlier versions (2.2.x and older) are not affected by this vulnerability (GitHub Advisory).

The vulnerability stems from a permission check bypass in eZ Platform v2.3.x that allows unauthorized access to user data. The issue was specifically related to the user controller component where proper permission validation was missing, allowing access to user information without proper authentication (Repository Commit).

When exploited, this vulnerability allows unauthenticated users to access sensitive user data including names and email addresses. However, it's important to note that passwords and password hashes remain secure and are not exposed through this vulnerability (Security Advisory).

The vulnerability allows unauthorized access to user data through a specific case of permission check bypass in the platform. The issue affects only version 2.3.x of the software, with earlier versions (2.2.x and older) remaining unaffected (GitHub Advisory).

Users are advised to update the ezsystems/repository-forms package to version 2.3.2.1 which contains the security fix. The update can be performed using Composer. Alternatively, users can manually apply the patch available in the repository commit ea82e136ec1ea40aca714abb79cc8e5bfece01e8 (Security Advisory).