PT-2007-5669 · Ez Systems · Ez Publish

Published 2007-08-23 · Updated 2015-07-27 · CVE-2007-4493

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eZ publish versions prior to 3.8.9 eZ publish versions 3.9.0 through 3.9.2

Description The issue is related to improper permission checks on module views without a policy function. This is demonstrated by a vulnerability in the discount functionality of the shop module, though the exact impact and attack vectors are not specified.

Recommendations For versions prior to 3.8.9, update to version 3.8.9 or later. For versions 3.9.0 through 3.9.2, update to version 3.9.3 or later.

Fix

Related Identifiers

CVE-2007-4493

Affected Products

Ez Publish

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-4493 · Security Note
• http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9 · Note
• http://osvdb.org/40324 · Note
• http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_9_2_to_3_9_3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4493 · Note
• http://securityfocus.com/bid/25539 · Note
• http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9 · Note
• http://secunia.com/advisories/26686 · Note