GHSA-cc2j-92jq-wgjg
eZ Publish Information disclosure in backend content tree menu
This security advisory fixes an information disclosure vulnerability in the legacy admin content tree menu. If a view has been disabled in site.ini [SiteAccessRules] Rules, and an attacker accesses the backend with the URL to this module, then the tree menu may be displayed. Since the tree menu may contain hidden items, this may lead to information disclosure. We recommend that you install this Security Update as soon as possible.
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/a4a0470f8d80f012fe14e4f8ab11c7d14375986c
What each source reports
GitHub AdvisoriesNo score
eZ Publish Information disclosure in backend content tree menu
This security advisory fixes an information disclosure vulnerability in the legacy admin content tree menu. If a view has been disabled in site.ini [SiteAccessRules] Rules, and an attacker accesses the backend with the URL to this module, then the tree menu may be displayed. Since the tree menu may contain hidden items, this may lead to information disclosure. We recommend that you install this Security Update as soon as possible.
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/a4a0470f8d80f012fe14e4f8ab11c7d14375986c
- Record
GHSA-cc2j-92jq-wgjg- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
eZ Publish Information disclosure in backend content tree menu
This security advisory fixes an information disclosure vulnerability in the legacy admin content tree menu. If a view has been disabled in site.ini [SiteAccessRules] Rules, and an attacker accesses the backend with the URL to this module, then the tree menu may be displayed. Since the tree menu may contain hidden items, this may lead to information disclosure. We recommend that you install this Security Update as soon as possible.
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/a4a0470f8d80f012fe14e4f8ab11c7d14375986c
- Record
GHSA-cc2j-92jq-wgjg- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezpublish-legacyPackagist | 2011.0.0 up to 2017.8.1.1 | 2017.8.1.1 |
ezsystems/ezpublish-legacyPackagist | 5.4.0 up to 5.4.10.1 | 5.4.10.1 |
ezsystems/ezpublish-legacyPackagist | 5.3.0 up to 5.3.12.2 | 5.3.12.2 |
ezsystems/ezpublish-legacyPackagist | 2011.0.0 up to 2017.8.1.1, plus listed versions 2013.04.0v2013.05.0v2013.06.0v2013.07.0v2013.07.1 Show 23 moreShow lessv2013.07.3v2013.09.0v2013.11v2014.01.0v2014.01.1v2014.01.2v2014.03.1v2014.03.2v2014.05.0v2014.05.1v2014.05.2v2014.07.0v2014.07.1v2014.07.2v2014.11.0v2014.11.1v2014.11.2v2015.01.0v2015.01.1v2015.01.2v2015.01.3v2017.08.0v2017.08.1 | 2017.8.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-cc2j-92jq-wgjg is a vulnerability with no CVSS score yet in ezsystems/ezpublish-legacy, published May 15, 2024. No source lists public exploit code. Fixed in ezsystems/ezpublish-legacy 2017.8.1.1.
References
github.com/ezsystems/ezpublish-legacy/commit/a4a0470f8d80f012fe14e4f8ab11c7d14375986c
share.ez.no/community-project/security-advisories/ezsa-2017-006-information-disclosure-in-backend-content-tree-menu