PT-2024-40191 · Ez Systems · Ez Publish Legacy+1

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: eZ Publish Platform versions prior to 5.4 eZ Publish Legacy versions prior to 5.4 VideoJS (affected versions not specified)

Description: The issue is related to an XSS vulnerability in the Flash-based video player of VideoJS, which is bundled in DemoBundle and the ezdemo legacy extension. This vulnerability may affect users of eZ Publish Platform 5.4 and eZ Publish Legacy 5.4, and potentially those using newer branches if the vulnerable software is installed. The estimated number of potentially affected devices is not provided.

Recommendations: For eZ Publish Platform versions prior to 5.4, remove the affected file to resolve the vulnerability, although this will break the video playback feature. For eZ Publish Legacy versions prior to 5.4, remove the affected file to resolve the vulnerability, although this will break the video playback feature. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-8C85-4RR5-CHR4

Affected Products

Ez Publish Legacy

Ez Publish Platform

References · 5

• https://osv.dev/vulnerability/GHSA-8c85-4rr5-chr4 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/demobundle/2020-04-21-1.yaml · Note
• https://github.com/ezsystems/DemoBundle · Note
• https://ezplatform.com/security-advisories/ezsa-2020-003-xss-in-demobundle-ezdemo-bundled-videojs · Note
• https://web.archive.org/web/20201024034648/https://ezplatform.com/security-advisories/ezsa-2020-003-xss-in-demobundle-ezdemo-bundled-videojs · Note