PT-2007-1494 · Ez Systems · Ez Publish

Published 2007-07-06 · Updated 2015-07-28 · CVE-2006-7218

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eZ publish versions prior to 3.8.1

Description The issue concerns improper permission enforcement for content edit language when there are four or more languages. This allows remote authenticated users to perform translations into languages not listed in a Module Function Limitation policy.

Recommendations For versions prior to 3.8.1, update to version 3.8.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-7218

Affected Products

Ez Publish

References · 5

• http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_0_to_3_8_1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-7218 · Security Note
• http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_8_0_to_3_9_0 · Note
• http://issues.ez.no/8539 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7218 · Note