GHSA-Q73V-79X3-JV2W

Vulnerability from github – Published: 2024-05-15 21:13 – Updated: 2024-05-15 21:13
VLAI
Summary
eZ Platform Admin UI Cross-site Scripting vulnerability
Details

This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds the necessary escaping of injected code. This resolves the issue both for code that has already been injected, and any future such code.

To install, use Composer to update "ezsystems/ezplatform-admin-ui" and "ezsystems/ezplatform-page-builder" to one of the "Resolving versions" mentioned above. (ezplatform-page-builder exists only in eZ Platform Enterprise Edition.)

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "ezsystems/ezplatform-admin-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "ezsystems/ezplatform-admin-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-15T21:13:43Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds the necessary escaping of injected code. This resolves the issue both for code that has already been injected, and any future such code.\n\nTo install, use Composer to update \"ezsystems/ezplatform-admin-ui\" and \"ezsystems/ezplatform-page-builder\" to one of the \"Resolving versions\" mentioned above. (ezplatform-page-builder exists only in eZ Platform Enterprise Edition.)",
  "id": "GHSA-q73v-79x3-jv2w",
  "modified": "2024-05-15T21:13:43Z",
  "published": "2024-05-15T21:13:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-admin-ui/CVE-2019-12139.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ezsystems/ezplatform-admin-ui"
    },
    {
      "type": "WEB",
      "url": "https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20201207160038/https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "eZ Platform Admin UI Cross-site Scripting vulnerability"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.