Lucene search

[email protected]CVE-2005-4856

HistoryOct 03, 2022 - 4:22 p.m.

CVE-2005-4856

2022-10-0316:22:46

CWE-19

[email protected]

web.nvd.nist.gov

cve-2005-4856

ez publish

remote attackers

authorization errors

security vulnerability

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.5%

JSON

The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle authorization errors, which allows remote attackers to obtain sensitive information and see the admin pagelayout and associated templates via a request with (1) “anything after the url” or (2) a “wrong url”.

Affected configurations

NVD

Node

ezez_publishRange≤3.8.0

ezez_publishMatch3.5.0

ezez_publishMatch3.5.1

ezez_publishMatch3.5.2

ezez_publishMatch3.5.3

ezez_publishMatch3.5.4

ezez_publishMatch3.5.5

ezez_publishMatch3.5.6

ezez_publishMatch3.6.0

ezez_publishMatch3.6.1

ezez_publishMatch3.6.2

ezez_publishMatch3.6.3

ezez_publishMatch3.6.4

ezez_publishMatch3.7.0

ezez_publishMatch3.7.1

ezez_publishMatch3.7.2

CPENameOperatorVersion
ez:ez_publishez ez publishle3.8.0
ez:ez_publishez ez publisheq3.5.0
ez:ez_publishez ez publisheq3.5.1
ez:ez_publishez ez publisheq3.5.2
ez:ez_publishez ez publisheq3.5.3
ez:ez_publishez ez publisheq3.5.4
ez:ez_publishez ez publisheq3.5.5
ez:ez_publishez ez publisheq3.5.6
ez:ez_publishez ez publisheq3.6.0
ez:ez_publishez ez publisheq3.6.1

CPE	Name	Operator	Version
ez:ez_publish	ez ez publish	le	3.8.0
ez:ez_publish	ez ez publish	eq	3.5.0
ez:ez_publish	ez ez publish	eq	3.5.1
ez:ez_publish	ez ez publish	eq	3.5.2
ez:ez_publish	ez ez publish	eq	3.5.3
ez:ez_publish	ez ez publish	eq	3.5.4
ez:ez_publish	ez ez publish	eq	3.5.5
ez:ez_publish	ez ez publish	eq	3.5.6
ez:ez_publish	ez ez publish	eq	3.6.0
ez:ez_publish	ez ez publish	eq	3.6.1

Rows per page:

1-10 of 161

References

ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0

issues.ez.no/6703

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.5%

JSON

Related for CVE-2005-4856

nvd1 ubuntucve1 cvelist1