Code injection

2020-03-2216:15:00

PRIOn knowledge base

www.prio-n.com

9.8 High

AI Score

Confidence

High

0.012 Low

EPSS

Percentile

85.1%

JSON

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.

CPENameOperatorVersion
ez_publish-kernelge7.0.0
ez_publish-kernellt7.5.6.2
ez_publish-kernelge6.0.0
ez_publish-kernellt6.13.6.2
ez_publish-kernellt5.4.14.1
ez_publish-legacylt5.4.14.1
ez_publish-legacyge2017.0
ez_publish-legacylt2017.12.7.2
ez_publish-legacyge2019.0
ez_publish-legacylt2019.03.4.2

Name	Operator	Version
ez_publish-kernel	ge	7.0.0
ez_publish-kernel	lt	7.5.6.2
ez_publish-kernel	ge	6.0.0
ez_publish-kernel	lt	6.13.6.2
ez_publish-kernel	lt	5.4.14.1
ez_publish-legacy	lt	5.4.14.1
ez_publish-legacy	ge	2017.0
ez_publish-legacy	lt	2017.12.7.2
ez_publish-legacy	ge	2019.0
ez_publish-legacy	lt	2019.03.4.2