Cross-site Scripting (XSS) Vulnerability in eZ Platform Admin UI
Summary
GHSA-w9p3-26fx-5mp3: eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS). Affects ezsystems/platform-ui-assets-bundle versions >= 4.2.0, < 4.2.3. Fixed in 4.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eZ Platform Admin UI is a user interface component used in the eZ Platform content management system. It provides a graphical interface for managing content, users, and other administrative tasks. The vulnerability in question is a Cross-site Scripting (XSS) vulnerability that exists in CKEditor, which is used by AlloyEditor, which in turn is used in eZ Platform Admin UI. This vulnerability allows an attacker to inject malicious scripts into the application, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The XSS vulnerability in CKEditor allows an attacker to inject scripts through specially crafted "protected" comments. This vulnerability affects eZ Platform Admin UI, which uses AlloyEditor. While it is not confirmed whether this vulnerability is exploitable in eZ Platform, it is recommended to install the fix to ensure security. The vulnerability has been fixed in CKEditor v4.14 and AlloyEditor v2.11.9. The affected versions of eZ Platform and the corresponding fixed versions of the vulnerable package are as follows:
- eZ Platform v1.13.x: ezsystems/PlatformUIAssetsBundle v4.2.3 (included from ezsystems/PlatformUIBundle v1.13.x)
- eZ Platform v2.5.13: ezsystems/ezplatform-admin-ui-assets v4.2.1
- eZ Platform v3.0.*: ezsystems/ezplatform-admin-ui-assets v5.0.1
- eZ Platform v3.1.2: ezsystems/ezplatform-admin-ui-assets v5.1.1
How To Fix
Minimum fixed version
4.2.3
This is the first release that contains the fix.
composer require ezsystems/platform-ui-assets-bundle:4.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the eZ Platform Admin UI is vulnerable to a Cross-site Scripting (XSS) vulnerability due to a vulnerability in CKEditor. It is recommended to update the affected package to the fixed version to ensure the security of your application. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ezsystems/platform-ui-assets-bundle →
FAQ
The vulnerability allows an attacker to inject malicious scripts into the application, potentially leading to unauthorized access, data theft, or other malicious activities.
It is not confirmed whether this vulnerability is exploitable in eZ Platform. However, it is recommended to install the fix to ensure security.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for vulnerabilities.
There are no known workarounds for this vulnerability. It is recommended to update the affected package to the fixed version.
You can find more information about the vulnerability in the GitHub Advisory Database. The link to the advisory is provided in the vulnerability details.
