PT-2007-5670 · Ez Systems · Ez Publish

Published 2007-08-23 · Updated 2015-07-27 · CVE-2007-4494

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions eZ publish versions prior to 3.8.9 eZ publish versions 3.9 prior to 3.9.3

Description The issue allows remote attackers to conduct spam attacks due to the lack of access limitation for anonymous users in the tipafriend function.

Recommendations For versions prior to 3.8.9, update to version 3.8.9 or later. For versions 3.9 prior to 3.9.3, update to version 3.9.3 or later.

Fix

Related Identifiers

CVE-2007-4494

Affected Products

Ez Publish

References · 8

• http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_9_2_to_3_9_3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-4494 · Security Note
• http://securityfocus.com/bid/25538 · Note
• http://osvdb.org/40325 · Note
• http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4494 · Note
• http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9 · Note
• http://secunia.com/advisories/26686 · Note