PT-2024-40034 · Ez Systems · Ez Publish Legacy

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions eZ Publish Legacy (affected versions not specified)

Description The issue concerns a vulnerability in eZ Publish Legacy that could lead to XSS injection in certain configurations, particularly when all modules are disabled. This vulnerability affects installations using Legacy via the LegacyBridge. The estimated number of potentially affected devices worldwide is not available.

Recommendations To resolve the issue, update to one of the resolving versions using Composer. As a temporary workaround, consider disabling the LegacyBridge until a patch is available. Restrict access to the module name input field to minimize the risk of XSS injection. Apply the patch manually from the provided commit to add necessary input washing.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-2VH3-CJ9J-MCJ5

Affected Products

Ez Publish Legacy

References · 6

• https://osv.dev/vulnerability/GHSA-2vh3-cj9j-mcj5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-01-1.yaml · Note
• https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9 · Note
• https://github.com/ezsystems/ezpublish-legacy · Note
• https://web.archive.org/web/20210614172734/http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template · Note
• http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template · Note