How severe is GHSA-45qm-j4m9-whv9?

No CVSS score has been assigned to GHSA-45qm-j4m9-whv9 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-45qm-j4m9-whv9?

GHSA-45qm-j4m9-whv9 affects the following packages: ezsystems/ezplatform (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-45qm-j4m9-whv9?

Update ezsystems/ezplatform to 2.5.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-45qm-j4m9-whv9 is resolved across your whole dependency graph.

How do I detect GHSA-45qm-j4m9-whv9 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ezsystems/ezplatform, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-45qm-j4m9-whv9 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-45qm-j4m9-whv9 actively exploited in the wild?

No public exploit code has been indexed for GHSA-45qm-j4m9-whv9 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-45qm-j4m9-whv9 published, and has it been updated?

GHSA-45qm-j4m9-whv9 was published on May 15, 2024 and was last updated on November 29, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

eZ Platform CSRF token in login form is disabled by default

Real-World Exposure

1 pkg affected

🐘ezsystems/ezplatform

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released.

If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this:

security:
    firewalls:
        ezpublish_front:
            form_login:
                csrf_token_generator: security.csrf.token_manager

NB: In eZ Platform 3.0 this file has been moved to config/packages/security.yaml

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`ezsystems/ezplatform`	≥ 2.5.0&&< 2.5.4	2.5.4`composer require ezsystems/ezplatform:^2.5.4`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ezsystems/ezplatform, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update ezsystems/ezplatform to 2.5.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-45qm-j4m9-whv9 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released. If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this: ``` security: firewalls: ezpublish_front:

O3 Security · Impact-Aware SCA

Is GHSA-45qm-j4m9-whv9 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works

eZ Platform CSRF token in login form is disabled by defaultGHSA-45qm-j4m9-whv9