CVE-2017-1000431 - eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g

Back Back to CVE browser

MEDIUM

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g

Published Jan 2, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 0.68%

Description

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

Link	Providers	Tags
http://share.ez.no/community-project/security-advisories/ezsa-2017-005-xss-issue-in-search		x_refsource_CONFIRMPatchVendor Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/CVE-2017-1000431.yaml
https://github.com/advisories/GHSA-m98q-p5gq-q5ff		Advisory
https://github.com/ezsystems/ezpublish-legacy/commit/c7174295fa0b9bd81bd4af908082464b0b80f278
https://nvd.nist.gov/vuln/detail/CVE-2017-1000431
https://web.archive.org/web/20210408035246/http://share.ez.no/community-project/security-advisories/ezsa-2017-005-xss-issue-in-search