CVE-2005-4851

2022-10-0316:22:44

mitre

www.cve.org

ez publish

remote access

permissions bypass

xml fields

6.2 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.2%

JSON

eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows remote authenticated users to bypass the original permissions on embedded objects in XML fields and read these objects.

References

ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0

issues.ez.no/6841