GHSA-cg84-55jx-4237: 
PHP vulnerability analysis and mitigation

The GHSA-cg84-55jx-4237 (EZSA-2019-002) is a high-severity password reset vulnerability affecting eZ Platform Admin UI. The vulnerability was discovered in eZ Platform 2.x, specifically affecting versions >= 1.4.0 and < 1.4.6 of the ezsystems/ezplatform-admin-ui package. The issue was disclosed on April 3, 2019, and patched in version 1.4.6 (GitHub Advisory).

The vulnerability exists in the forgotten password reset functionality of eZ Platform Admin UI, which was susceptible to brute force attacks. The weakness is classified as CWE-307. The severity is rated as High, though no specific CVSS score was assigned (GitHub Advisory).

Depending on configuration and circumstances, an attacker could potentially exploit this vulnerability to gain unauthorized control over user accounts through the password reset mechanism (EZ Advisory).

The vulnerability could be exploited through brute force attacks against the password reset functionality. The default configuration allowed password reset requests to remain valid for 1 hour, potentially providing attackers with a significant window of opportunity (GitHub Advisory).

The vulnerability was patched in version 1.4.6 of ezsystems/ezplatform-admin-ui. Users are recommended to update to the patched version. Additionally, administrators can strengthen security by reducing the password reset request validity period from the default 1 hour, while ensuring sufficient time for email delivery and user response. For eZ Platform 2.5 users, updating ezsystems/ezplatform-user to v1.0.1 is required, while eZ Platform 2.4 users need to update ezsystems/ezplatform-admin-ui to v1.4.6, ezsystems/ezplatform-admin-ui-modules to v1.4.4, and ezsystems/repository-forms to v2.4.5 (EZ Advisory).