PT-2005-5517 · Ez Systems · Ez Publish

Publicado 2005-12-31 · Atualizado 2015-07-28 · CVE-2005-4856

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: eZ publish versions 3.5 through 3.5.6 eZ publish versions 3.6 through 3.6.4 eZ publish versions 3.7 through 3.7.2 eZ publish versions 3.8 before 20051110

Description: The admin interface does not properly handle authorization errors, allowing remote attackers to obtain sensitive information and see the admin page layout and associated templates via a request with incorrect URL parameters, such as anything after the url or a wrong url.

Recommendations: For eZ publish versions 3.5 through 3.5.6, update to version 3.5.7 or later. For eZ publish versions 3.6 through 3.6.4, update to version 3.6.5 or later. For eZ publish versions 3.7 through 3.7.2, update to version 3.7.3 or later. For eZ publish versions 3.8 before 20051110, update to a version released on or after 20051110.

Correção

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

CVE-2005-4856

Produtos afetados

Ez Publish

Referências · 4

• http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 · Nota
• http://issues.ez.no/6703 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4856 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4856 · Nota de Segurança