Security advisory: IBEXA-SA-2021-004

When using the Map/Host URL matcher, the frontend client-side code includes a reference to the backend URL. This in itself does not breach the backend. One would also need a valid login (and VPN access if network-level protections are in place). However it is better not to expose the backend URL. The fix ensures that the backend URL reference is only present when the frontend is called by the backend, as Page Builder does for preview purposes.

The issue affect releases that include Page Builder v1.3 and newer, so eZ Platform Enterprise Edition v2.5, and Ibexa Experience and Ibexa Commerce v3.2 and v3.3.