Lucene search
HistoryOct 03, 2022 - 4:22 p.m.
CVE-2005-4853
cve-2005-4853
ez publish
forum package
security vulnerability
remote authenticated users
edit permissions
9.4 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:C/A:C
6.4 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
61.2%
The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050818 does not restrict edit permissions to a posting’s owner, which allows remote authenticated users to edit arbitrary postings.
Affected configurations
Node
ezez_publishMatch3.5.0
ORezez_publishMatch3.5.1
ORezez_publishMatch3.5.2
ORezez_publishMatch3.5.3
ORezez_publishMatch3.5.4
Related
ubuntucve
ubuntucve
CVE-2005-4853
2005-12-31 00:00:00
nvd
nvd
CVE-2005-4853
2005-12-31 05:00:00
cvelist
cvelist
CVE-2005-4853
2022-10-03 16:22:45
9.4 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:C/A:C
6.4 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
61.2%
Related for CVE-2005-4853