PT-2021-24438 · Ez Systems · Ez Publish Legacy

Published 2021-09-07 · Updated 2021-09-07

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: eZ Publish Legacy (affected versions not specified)

Description: The issue concerns a potential SQL injection vulnerability in the content object state code of eZ Publish Legacy. Although there are no known exploits, it is theoretically possible for one to exist. The estimated number of potentially affected devices worldwide is not available.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-JPWX-FFJQ-WR4W

Affected Products

Ez Publish Legacy

References · 5

• https://osv.dev/vulnerability/GHSA-jpwx-ffjq-wr4w · Vendor Advisory
• https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-jpwx-ffjq-wr4w · Note
• https://github.com/ezsystems/ezpublish-legacy/commit/f8e3a97afd92efb9148134a4bacb35a875777a42 · Note
• https://github.com/ezsystems/ezpublish-legacy · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2021-005-content-object-state-fetch-functions-open-to-sql-injection · Note