PT-2024-40240 · Unknown · Ez Publish Legacy

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: ezpublish-legacy (affected versions not specified)

Description: The issue is related to an information disclosure vulnerability in the legacy admin content tree menu. If a view has been disabled in site.ini [SiteAccessRules] Rules and an attacker accesses the backend with the URL to this module, the tree menu may be displayed, potentially leading to information disclosure because the tree menu may contain hidden items.

Recommendations: To resolve the issue, install the Security Update as soon as possible by updating to one of the recommended versions using Composer. Alternatively, apply the provided patch manually.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-CC2J-92JQ-WGJG

Affected Products

Ez Publish Legacy

References · 5

• https://osv.dev/vulnerability/GHSA-cc2j-92jq-wgjg · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2017-09-11-1.yaml · Note
• https://github.com/ezsystems/ezpublish-legacy/commit/a4a0470f8d80f012fe14e4f8ab11c7d14375986c · Note
• https://github.com/ezsystems/ezpublish-legacy · Note
• http://share.ez.no/community-project/security-advisories/ezsa-2017-006-information-disclosure-in-backend-content-tree-menu · Note