GHSA-2w9p-xxqr-h253
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2w9p-xxqr-h253
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-2w9p-xxqr-h253/GHSA-2w9p-xxqr-h253.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-2w9p-xxqr-h253
- Published
- 2024-05-15T21:14:18Z
- Modified
- 2024-11-29T05:39:38.887115Z
- Summary
- eZ Platform Object Injection in SiteAccessMatchListener
- Details
-
This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.
Update: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-94" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-05-15T21:14:18Z" }- References
-
- https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-kernel/2020-05-20-1.yaml
- https://github.com/ezsystems/ezplatform-kernel
- https://web.archive.org/web/20201024030303/https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener
Affected packages
Packagist / ezsystems/ezplatform-kernel
Package
- Name
- ezsystems/ezplatform-kernel
- Purl
- pkg:composer/ezsystems/ezplatform-kernel