CVE-2008-6844

The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other...

7.5 HighPublic exploit

The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters.

Exploit likelihood

2.97%Down 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2008-6844
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-6844
Updated: 2026-11-02

EUVDEUVD-2008-6804 No score

Record: EUVD-2008-6804
Updated: 2026-11-03

GitHub AdvisoriesGHSA-h9fw-hm8c-pxx3 No score

The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other...

Record: GHSA-h9fw-hm8c-pxx3
Updated: 2026-11-02

Affected products

ez publish

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	EZ Publish < 3.9.5/3.10.1/4.0.1 - Privilege Escalation	2008-12-10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-6844 is a high vulnerability (CVSS 7.5) in Ez Publish, published July 2, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.97%, the 87th percentile. No source names a fixed version.