Packagist/ezsystems/ezpublish-legacy: medium
eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template
Action: Upgrade ezsystems/ezpublish-legacy to 5.3.12.5 or later.
composer require ezsystems/ezpublish-legacy:2018.9.1.2composer require ezsystems/ezpublish-legacy:2018.6.1.3composer require ezsystems/ezpublish-legacy:2017.12.4.2composer require ezsystems/ezpublish-legacy:5.4.12.2composer require ezsystems/ezpublish-legacy:5.3.12.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 2018.9.0 | 2018.9.1.2 | - |
| 2018.6.0 | 2018.6.1.3 | - |
| 2011.0.0 | 2017.12.4.2 | - |
| 5.4.0 | 5.4.12.2 | - |
| 5.3.0 | 5.3.12.5 | - |
Fixed versions
| 2018.9.1.2 | 2018.6.1.3 | 2017.12.4.2 | 5.4.12.2 | 5.3.12.5 |
Sources
- osv: GHSA-2vh3-cj9j-mcj5
- https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-01-1.yaml
- https://github.com/ezsystems/ezpublish-legacy
- https://web.archive.org/web/20210614172734/http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template
- http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template
published · modified · JSON