Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zOWoyLTRwOWotNXc0as4AA8IQ

Ez Platform Object Injection in legacy shop module

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.

Permalink: https://github.com/advisories/GHSA-39j2-4p9j-5w4j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zOWoyLTRwOWotNXc0as4AA8IQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 6 months ago
Updated: 6 months ago

Identifiers: GHSA-39j2-4p9j-5w4j
References:

• https://ezplatform.com/security-advisories/ibexa-sa-2020-006-object-injection-in-legacy-shop-module
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2020-10-05-1.yaml
• https://github.com/advisories/GHSA-39j2-4p9j-5w4j

Blast Radius: 0.0

Affected Packages