GHSA-39j2-4p9j-5w4j
Ez Platform Object Injection in legacy shop module
This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.
What each source reports
GitHub AdvisoriesNo score
Ez Platform Object Injection in legacy shop module
This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.
- Record
GHSA-39j2-4p9j-5w4j- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVNo score
Ez Platform Object Injection in legacy shop module
This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.
- Record
GHSA-39j2-4p9j-5w4j- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezpublish-legacyPackagist | 2019.3.0 up to 2019.3.5.1 | 2019.3.5.1 |
ezsystems/ezpublish-legacyPackagist | 2017.12.0 up to 2017.12.7.3 | 2017.12.7.3 |
ezsystems/ezpublish-legacyPackagist | 5.4.0 up to 5.4.14.2 | 5.4.14.2 |
ezsystems/ezpublish-legacyPackagist | 2019.3.0 up to 2019.3.5.1, plus listed versions v2019.03.0v2019.03.1v2019.03.2v2019.03.3v2019.03.4v2019.03.4.2v2019.03.5 | 2019.3.5.1 |
ezsystems/ezpublish-legacyPackagist | 2017.12.0 up to 2017.12.7.3, plus listed versions v2017.12.0v2017.12.1v2017.12.1.1v2017.12.2v2017.12.2.1 Show 12 moreShow lessv2017.12.2.2v2017.12.3v2017.12.3.1v2017.12.3.2v2017.12.4v2017.12.4.1v2017.12.4.2v2017.12.4.3v2017.12.5v2017.12.6v2017.12.7v2017.12.7.2 | 2017.12.7.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-39j2-4p9j-5w4j is a vulnerability with no CVSS score yet in ezsystems/ezpublish-legacy, published May 15, 2024. No source lists public exploit code. Fixed in ezsystems/ezpublish-legacy 2019.3.5.1.