GHSA-mrvj-7q4f-5p42: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in eZ Platform Ibexa Kernel before version 1.3.1.1, identified as GHSA-mrvj-7q4f-5p42. The vulnerability allows attackers to upload JavaScript code through .html or .js files, which can then be executed when victims access links to these files. The affected versions include eZ Platform Kernel 1.2.x before 1.2.5.1, 1.3.x before 1.3.1.1, 6.13.x before 6.13.8.2, and 7.5.x before 7.5.15.2 (GitHub Advisory).

The vulnerability is classified as a Cross-site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 6.1 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability exists in the file upload functionality where the application fails to properly restrict uploadable file types, specifically allowing .html and .js files that can contain malicious JavaScript code (NVD).

When exploited, this vulnerability allows attackers to execute JavaScript code in the context of other users' browsers when they access the uploaded malicious files. This can lead to theft of sensitive information, session hijacking, or other client-side attacks (GitHub Advisory).

The vulnerability requires no special privileges to exploit, though it does require user interaction (the victim must access a link to the malicious file). The attack can be performed remotely, and the complexity of the attack is considered low (NVD).

The vulnerability has been patched in versions 1.2.5.1, 1.3.1.1, 6.13.8.2, and 7.5.15.2. The fix involves adding common types of scriptable file types to the configuration of the existing filetype blacklist feature. For users unable to upgrade immediately, a manual workaround is available by updating the 'ezsettings.default.io.file_storage.file_type_blacklist' configuration to include the problematic file types (GitHub Advisory).