GHSA-2vh3-cj9j-mcj5: XSS
First published: Wed May 15 2024(Updated: )
This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy via the LegacyBridge. Installations where all modules are disabled may be vulnerable to XSS injection in the module name. This is a rare configuration, but we still recommend installing the update, which adds the necessary input washing. To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/ezsystems/ezpublish-legacy | >=5.3.0<5.3.12.5 | 5.3.12.5 |
| composer/ezsystems/ezpublish-legacy | >=5.4.0<5.4.12.2 | 5.4.12.2 |
| composer/ezsystems/ezpublish-legacy | >=2011.0.0<2017.12.4.2 | 2017.12.4.2 |
| composer/ezsystems/ezpublish-legacy | >=2018.6.0<2018.6.1.3 | 2018.6.1.3 |
| composer/ezsystems/ezpublish-legacy | >=2018.9.0<2018.9.1.2 | 2018.9.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-01-1.yaml
- https://web.archive.org/web/20210614172734/http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template
- http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template
- https://github.com/advisories/GHSA-2vh3-cj9j-mcj5 (Advisory)
Frequently Asked Questions
What is the severity of GHSA-2vh3-cj9j-mcj5?
The severity of GHSA-2vh3-cj9j-mcj5 is classified as critical due to the potential for XSS injection.
How do I fix GHSA-2vh3-cj9j-mcj5?
To fix GHSA-2vh3-cj9j-mcj5, upgrade to eZ Publish Legacy version 5.3.12.5, 5.4.12.2, 2017.12.4.2, 2018.6.1.3, or 2018.9.1.2.
Who is affected by GHSA-2vh3-cj9j-mcj5?
Users of eZ Publish Legacy with modules disabled via the LegacyBridge are affected by GHSA-2vh3-cj9j-mcj5.
What kind of vulnerability is GHSA-2vh3-cj9j-mcj5?
GHSA-2vh3-cj9j-mcj5 describes a Cross-Site Scripting (XSS) vulnerability.
What should I do if I can't upgrade immediately for GHSA-2vh3-cj9j-mcj5?
If an immediate upgrade is not possible for GHSA-2vh3-cj9j-mcj5, consider disabling the affected modules until an upgrade can be performed.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-2vh3-cj9j-mcj5
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/tags
- agent/source
- package-manager/composer