PT-2005-5516 · Ez Systems · Ez Publish

Publicado 2005-12-31 · Atualizado 2018-09-27 · CVE-2005-4855

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: eZ publish versions 3.5 through 3.5.5 eZ publish versions 3.6 through 3.6.2 eZ publish versions 3.7 through 3.7.0rc2 eZ publish versions 3.8 through 20050922

Description: The issue allows remote authenticated users to upload certain types of files, such as .js files, due to a lack of restriction on Image datatype uploads to image content types. This may enable cross-site scripting (XSS) attacks or other attacks.

Recommendations: For eZ publish versions 3.5 through 3.5.5, update to version 3.5.5 or later. For eZ publish versions 3.6 through 3.6.2, update to version 3.6.2 or later. For eZ publish versions 3.7 through 3.7.0rc2, update to version 3.7.0rc2 or later. For eZ publish versions 3.8 through 20050922, update to a version later than 20050922.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2005-4855

Produtos afetados

Ez Publish

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4855 · Nota
• http://issues.ez.no/5984 · Aviso do Fabricante
• http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4855 · Nota de Segurança