GHSA-2vh3-cj9j-mcj5 eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template
Attackers can inject scripts via module names in disabled module error templates, requiring user interaction to execute.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-2vh3-cj9j-mcj5?
GHSA-2vh3-cj9j-mcj5 is a cross-site scripting vulnerability in ezsystems/ezpublish-legacy, published on 15 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy via the LegacyBridge.
Installations where all modules are disabled may be vulnerable to XSS injection in the module name. This is a rare configuration, but we still recommend installing the update, which adds the necessary input washing.
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9
Which versions are affected by GHSA-2vh3-cj9j-mcj5?
10 open source packages ship an affected version, including ezsystems/ezpublish-legacy.
| Package | Affected | Fixed in |
|---|---|---|
ezsystems/ezpublish-legacy Packagist | From 2011.0.0 | 2017.12.4.2 |
ezsystems/ezpublish-legacy Packagist | From 2011.0.0 | 2017.12.4.2 |
ezsystems/ezpublish-legacy Packagist | From 2018.6.0 | 2018.6.1.3 |
ezsystems/ezpublish-legacy Packagist | From 2018.6.0 | 2018.6.1.3 |
ezsystems/ezpublish-legacy Packagist | From 2018.9.0 | 2018.9.1.2 |
ezsystems/ezpublish-legacy Packagist | From 2018.9.0 | 2018.9.1.2 |
4 more packages
ezsystems/ezpublish-legacy Packagist | From 5.3.0 | 5.3.12.5 |
ezsystems/ezpublish-legacy Packagist | From 5.3.0 | 5.3.12.5 |
ezsystems/ezpublish-legacy Packagist | From 5.4.0 | 5.4.12.2 |
ezsystems/ezpublish-legacy Packagist | From 5.4.0 | 5.4.12.2 |
How do I fix GHSA-2vh3-cj9j-mcj5?
Upgrade ezsystems/ezpublish-legacy to a fixed version for your release line: 2017.12.4.2, 2018.6.1.3, 2018.9.1.2 or 5.3.12.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-2vh3-cj9j-mcj5 being exploited?
There is no known exploitation of GHSA-2vh3-cj9j-mcj5 in the wild and no public exploit code.