PT-2024-40114 · Ez Systems · Ezplatform-Kernel+1

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: ezsystems/ezplatform-kernel versions prior to v1.0.3 ezsystems/ezpublish-kernel versions prior to v7.5.8 ezsystems/ezpublish-kernel versions prior to v6.13.6.4 ezsystems/ezpublish-kernel versions prior to v5.4.15

Description: The issue is an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE). All sites may be affected.

Recommendations: For ezsystems/ezplatform-kernel versions prior to v1.0.3, update to v1.0.3 or later. For ezsystems/ezpublish-kernel versions prior to v7.5.8, update to v7.5.8 or later. For ezsystems/ezpublish-kernel versions prior to v6.13.6.4, update to v6.13.6.4 or later. For ezsystems/ezpublish-kernel versions prior to v5.4.15, update to v5.4.15 or later.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

GHSA-64VJ-933F-6PM3

Affected Products

Ezplatform-Kernel

Ezpublish-Kernel

References · 4

• https://osv.dev/vulnerability/GHSA-64vj-933f-6pm3 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-kernel/2020-05-20-1.yaml · Note
• https://github.com/ezsystems/ezpublish-kernel · Note
• https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener · Note