PT-2024-40035 · Ez Systems · Ezplatform-Kernel+1

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ezsystems/ezplatform-kernel versions prior to v1.0.3 ezsystems/ezpublish-kernel versions prior to v7.5.8 ezsystems/ezpublish-kernel versions prior to v6.13.6.4 ezsystems/ezpublish-kernel versions prior to v5.4.15

Description The issue is an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE). All sites may be affected.

Recommendations For ezsystems/ezplatform-kernel versions prior to v1.0.3, update to v1.0.3 or later. For ezsystems/ezpublish-kernel versions prior to v7.5.8, update to v7.5.8 or later. For ezsystems/ezpublish-kernel versions prior to v6.13.6.4, update to v6.13.6.4 or later. For ezsystems/ezpublish-kernel versions prior to v5.4.15, update to v5.4.15 or later.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

GHSA-2W9P-XXQR-H253

Affected Products

Ezplatform-Kernel

Ezpublish-Kernel

References · 5

• https://osv.dev/vulnerability/GHSA-2w9p-xxqr-h253 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-kernel/2020-05-20-1.yaml · Note
• https://github.com/ezsystems/ezplatform-kernel · Note
• https://web.archive.org/web/20201024030303/https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener · Note
• https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener · Note