eZ Platform Admin UI Cross-site Scripting vulnerability in ezsystems/ezplatform-admin-ui
Summary
GHSA-q73v-79x3-jv2w: eZ Platform Admin UI Cross-site Scripting vulnerability. Affects ezsystems/ezplatform-admin-ui across 2 version ranges.
>= 1.3.0, < 1.3.5
>= 1.4.0, < 1.4.4
Fixed in 1.3.5 or 1.4.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eZ Platform Admin UI is a package available on Packagist that provides a user interface for managing content in eZ Platform. It is a crucial component for websites that use eZ Platform as their content management system. This package allows administrators to create, edit, and delete content, manage user accounts, and perform other administrative tasks. Unfortunately, a severe vulnerability has been discovered in the Admin UI that exposes websites to cross-site scripting (XSS) attacks. This vulnerability affects all 2.x versions of eZ Platform, especially those that allow user-generated content.
Vulnerability Detail
The vulnerability in the eZ Platform Admin UI allows for the injection of malicious code through user-generated content. This means that an attacker can craft content that includes JavaScript code, which will be executed when viewed by other users. This can lead to various malicious activities, such as stealing sensitive information, manipulating website content, or redirecting users to malicious websites. The vulnerability has been addressed by adding proper code escaping, which prevents the execution of injected code. It is crucial to update the affected package to the fixed version to mitigate the risk of XSS attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.3.0, < 1.3.51.3.5composer require ezsystems/ezplatform-admin-ui:1.3.5 -
>= 1.4.0, < 1.4.41.4.4composer require ezsystems/ezplatform-admin-ui:1.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The eZ Platform Admin UI package is vulnerable to cross-site scripting (XSS) attacks, which can have severe consequences for websites that allow user-generated content. It is crucial to update the package to the fixed version to mitigate the risk of exploitation. Use Composer to update the ezsystems/ezplatform-admin-ui package to one of the resolving versions mentioned in the advisory. If you have any further questions or need assistance with vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for ezsystems/ezplatform-admin-ui →
FAQ
If your website uses eZ Platform and allows user-generated content, it is at risk of being exploited through this vulnerability. Attackers can inject malicious code that will be executed when other users view the content, potentially leading to various security issues.
Yes, all 2.x versions of eZ Platform are affected by this vulnerability. It is crucial to update the ezsystems/ezplatform-admin-ui package to the fixed version to mitigate the risk.
No, there is no known workaround for this vulnerability. The only solution is to update the affected package to the fixed version.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your composer.lock file to identify any open-source vulnerabilities, including this one.
You can find more information about this vulnerability, including the advisory and the fixed versions, in the GitHub advisory database. The link to the specific advisory is provided in the vulnerability details section.
References
Related vulnerabilities
Recent vulnerabilities recorded for ezsystems/ezplatform-admin-ui.
