GHSA-39j2-4p9j-5w4j Ez Platform Object Injection in legacy shop module
A backend editor with discount rule permissions can perform object injection in the legacy shop module, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-39j2-4p9j-5w4j?
GHSA-39j2-4p9j-5w4j is an unsafe deserialization vulnerability in ezsystems/ezpublish-legacy, published on 15 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Which versions are affected by GHSA-39j2-4p9j-5w4j?
6 open source packages ship an affected version, including ezsystems/ezpublish-legacy.
| Package | Affected | Fixed in |
|---|---|---|
ezsystems/ezpublish-legacy Packagist | From 2017.12.0 | 2017.12.7.3 |
ezsystems/ezpublish-legacy Packagist | From 2017.12.0 | 2017.12.7.3 |
ezsystems/ezpublish-legacy Packagist | From 2019.3.0 | 2019.3.5.1 |
ezsystems/ezpublish-legacy Packagist | From 2019.3.0 | 2019.3.5.1 |
ezsystems/ezpublish-legacy Packagist | From 5.4.0 | 5.4.14.2 |
ezsystems/ezpublish-legacy Packagist | From 5.4.0 | 5.4.14.2 |
How do I fix GHSA-39j2-4p9j-5w4j?
Upgrade ezsystems/ezpublish-legacy to a fixed version for your release line: 2017.12.7.3, 2019.3.5.1 or 5.4.14.2.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-39j2-4p9j-5w4j being exploited?
There is no known exploitation of GHSA-39j2-4p9j-5w4j in the wild and no public exploit code.