GHSA-7vwg-39h8-8qp8: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-7vwg-39h8-8qp8) affects the /user/sessions endpoint in eZ Platform v1.13, v2.5, v3.2, and Ibexa DXP and Ibexa Open Source v3.3. The issue was discovered and published on March 9, 2021, affecting the ezsystems/ezplatform-rest package versions 1.2.0 through 1.2.2.0 and 1.3.0 through 1.3.1.0. The vulnerability allows attackers to detect valid user accounts through differences in response data or response time of certain requests (GitHub Advisory).

The vulnerability is classified as High severity and is associated with CWE-203. The issue specifically relates to the authentication mechanism in the /user/sessions endpoint, where timing differences and response data variations could be used to enumerate valid user accounts. The fix implemented includes adding random delay times between 30,000 and 500,000 microseconds to prevent timing-based attacks (GitHub Commit).

The vulnerability enables attackers to determine whether specific usernames or email addresses correspond to valid accounts in the system, potentially facilitating further attacks such as brute force attempts or targeted phishing campaigns (GitHub Advisory).

The vulnerability can be exploited by analyzing differences in response data and timing from the /user/sessions endpoint. No specific exploit code or evidence of exploitation in the wild has been publicly documented (GitHub Advisory).

The vulnerability has been patched in versions 1.2.2.1 and 1.3.1.1. The fix implements consistent response timing and data patterns to prevent account enumeration. Users are advised to upgrade to these patched versions through Composer (GitHub Advisory, Packagist).