Object Injection Vulnerability in eZ Platform
Summary
GHSA-2w9p-xxqr-h253: eZ Platform Object Injection in SiteAccessMatchListener. Affects ezsystems/ezplatform-kernel versions >= 1.0.0, < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eZ Platform is an open-source content management system (CMS) that allows users to create and manage digital content. It provides a flexible and scalable platform for building websites, applications, and digital experiences. The eZ Platform kernel is a core component of the CMS, responsible for handling various functionalities and interactions. Unfortunately, a vulnerability has been discovered in the SiteAccessMatchListener of eZ Platform, which could potentially lead to remote code execution (RCE). This vulnerability affects all sites using eZ Platform.
Vulnerability Detail
The object injection vulnerability in the SiteAccessMatchListener of eZ Platform allows an attacker to inject malicious objects into the application, potentially leading to remote code execution. By exploiting this vulnerability, an attacker could execute arbitrary code on the server, gaining unauthorized access and control over the affected system. This is a critical security issue that requires immediate attention and remediation.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
composer require ezsystems/ezplatform-kernel:1.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected package to the fixed version as soon as possible.
Conclusion
The object injection vulnerability in eZ Platform is a critical security issue that can lead to remote code execution. It is essential to update the affected package to the fixed version (1.0.3 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ezsystems/ezplatform-kernel →
FAQ
eZ Platform is an open-source content management system (CMS) used for creating and managing digital content.
The SiteAccessMatchListener is a component in eZ Platform responsible for matching site access rules based on the requested URL.
Object injection is a vulnerability that allows an attacker to inject malicious objects into an application, potentially leading to remote code execution.
The object injection vulnerability in eZ Platform can result in remote code execution, allowing an attacker to execute arbitrary code on the server and gain unauthorized access and control over the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for ezsystems/ezplatform-kernel.
