VulertSecurity VulertSecurity

eZ Platform Editor Cross-site Scripting (XSS) Vulnerability

ezsystems/ezplatform-admin-ui-assets Updated 02 Oct 2025

Summary

15/05/2024
MODERATE
Yes i
Moderate
Not published

GHSA-4c2w-v5rq-5mx7: eZ Platform Editor Cross-site Scripting (XSS). Affects ezsystems/ezplatform-admin-ui-assets across 3 version ranges.

>= 4.2.0, < 4.2.1 >= 5.0.0, < 5.0.1 >= 5.1.0, < 5.1.1

Fixed in 4.2.1, 5.0.1 or 5.1.1, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats
SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml
Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile
Javascript package-lock.json · yarn.lock · pnpm-lock.yaml
PHP composer.lock
Python poetry.lock · requirements.txt · Pipfile.lock
Go go.mod
Rust Cargo.lock
Ruby Gemfile.lock
Dart pubspec.lock
C/C++ conan.lock
Elixir mix.lock
Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions.

Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

Background

eZ Platform is an open-source content management system (CMS) that allows users to create, manage, and publish content on the web. It includes various components and modules for different functionalities, such as the eZ Platform Admin UI, which provides a user interface for managing the CMS. The eZ Platform Admin UI utilizes CKEditor, an open-source rich text editor, which is vulnerable to cross-site scripting (XSS) attacks. This vulnerability can potentially allow an attacker to inject malicious scripts into the CMS, leading to unauthorized access, data theft, or other malicious activities.

Vulnerability Detail

The vulnerability lies in CKEditor, which is used by AlloyEditor, a component integrated into eZ Platform Admin UI. The issue arises from the ability to inject scripts through specially crafted 'protected' comments. Although it is uncertain whether this vulnerability is exploitable in eZ Platform, it is recommended to install the update to ensure security. The vulnerability has been addressed in CKEditor v4.14 and AlloyEditor v2.11.9. The affected packages in eZ Platform are:

  • ezsystems/PlatformUIAssetsBundle v4.2.3 (included from ezsystems/PlatformUIBundle v1.13.x) for eZ Platform v1.13.x
  • ezsystems/ezplatform-admin-ui-assets v4.2.1 for eZ Platform v2.5.13
  • ezsystems/ezplatform-admin-ui-assets v5.0.1 for eZ Platform v3.0.*
  • ezsystems/ezplatform-admin-ui-assets v5.1.1 for eZ Platform v3.1.2

This vulnerability is classified as moderate severity (CWE-79) and should be addressed promptly to mitigate potential risks.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • >= 4.2.0, < 4.2.1 4.2.1 
    composer require ezsystems/ezplatform-admin-ui-assets:4.2.1
  • >= 5.0.0, < 5.0.1 5.0.1 
    composer require ezsystems/ezplatform-admin-ui-assets:5.0.1
  • >= 5.1.0, < 5.1.1 5.1.1 
    composer require ezsystems/ezplatform-admin-ui-assets:5.1.1

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Conclusion

The eZ Platform Editor XSS vulnerability in CKEditor and AlloyEditor poses a moderate security risk to eZ Platform installations. It is crucial to update the affected packages to the recommended versions to mitigate the potential risks associated with this vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for ezsystems/ezplatform-admin-ui-assets →

Share this vulnerability

FAQ

What is eZ Platform?

eZ Platform is an open-source content management system (CMS) that allows users to create, manage, and publish content on the web. It provides various components and modules for different functionalities, including the eZ Platform Admin UI.

CKEditor is an open-source rich text editor used in eZ Platform Admin UI. It enables users to create and edit content with a wide range of formatting options.

AlloyEditor is a component integrated into eZ Platform Admin UI, which utilizes CKEditor for rich text editing capabilities.

Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or other malicious activities.

To update the affected packages, you can use Composer, a dependency management tool for PHP. Run the command 'composer update' in your project directory to update the packages to the recommended versions.

References

Related vulnerabilities

Recent vulnerabilities recorded for ezsystems/ezplatform-admin-ui-assets.

View all ezsystems/ezplatform-admin-ui-assets vulnerabilities →
Sponsored MarkAI Find prospects already talking about the problem you solve AI watches the communities your customers use to find qualified prospects, then alerts you when a conversation is worth joining. See MarkAI

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • >= 4.2.0, < 4.2.1 4.2.1 
    composer require ezsystems/ezplatform-admin-ui-assets:4.2.1
  • >= 5.0.0, < 5.0.1 5.0.1 
    composer require ezsystems/ezplatform-admin-ui-assets:5.0.1
  • >= 5.1.0, < 5.1.1 5.1.1 
    composer require ezsystems/ezplatform-admin-ui-assets:5.1.1

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →
Help improve this record
Report an issue or send feedback