PT-2005-5517 · Ez Systems · Ez Publish

Published 2005-12-31 · Updated 2015-07-28 · CVE-2005-4856

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: eZ publish versions 3.5 through 3.5.6 eZ publish versions 3.6 through 3.6.4 eZ publish versions 3.7 through 3.7.2 eZ publish versions 3.8 before 20051110

Description: The admin interface does not properly handle authorization errors, allowing remote attackers to obtain sensitive information and see the admin page layout and associated templates via a request with incorrect URL parameters, such as anything after the url or a wrong url.

Recommendations: For eZ publish versions 3.5 through 3.5.6, update to version 3.5.7 or later. For eZ publish versions 3.6 through 3.6.4, update to version 3.6.5 or later. For eZ publish versions 3.7 through 3.7.2, update to version 3.7.3 or later. For eZ publish versions 3.8 before 20051110, update to a version released on or after 20051110.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

CVE-2005-4856

Affected Products

Ez Publish

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4856 · Security Note
• http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 · Note
• http://issues.ez.no/6703 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4856 · Note