eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type

2022-05-2417:12:08

Google

osv.dev

8.2 High

AI Score

Confidence

High

0.012 Low

EPSS

Percentile

85.1%

JSON

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.

CPENameOperatorVersion
ezsystems/ezpublish-kerneleq7.1.0.1
ezsystems/ezpublish-kerneleq6.6.1-rc1
ezsystems/ezpublish-kerneleq6.7.0-rc1
ezsystems/ezpublish-kerneleq7.3.3
ezsystems/ezpublish-kerneleq6.7.0.1
ezsystems/ezpublish-kerneleq6.12.0.2
ezsystems/ezpublish-legacyeq2017.12.1.1
ezsystems/ezpublish-kerneleq6.12.0-beta2
ezsystems/ezpublish-kerneleq6.3.2-beta3
ezsystems/ezpublish-kerneleq6.7.7

Name	Operator	Version
ezsystems/ezpublish-kernel	eq	7.1.0.1
ezsystems/ezpublish-kernel	eq	6.6.1-rc1
ezsystems/ezpublish-kernel	eq	6.7.0-rc1
ezsystems/ezpublish-kernel	eq	7.3.3
ezsystems/ezpublish-kernel	eq	6.7.0.1
ezsystems/ezpublish-kernel	eq	6.12.0.2
ezsystems/ezpublish-legacy	eq	2017.12.1.1
ezsystems/ezpublish-kernel	eq	6.12.0-beta2
ezsystems/ezpublish-kernel	eq	6.3.2-beta3
ezsystems/ezpublish-kernel	eq	6.7.7