{"id":"CVE-2017-1000431","aliases":["EUVD-2022-4533","GHSA-m98q-p5gq-q5ff"],"status":"published","title":"eZ Publish Cross-site Scripting (XSS) vulnerability","description":"eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00679,"percentile":0.52618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-01-02T20:00:00Z","modified":"2026-06-17T00:59:10Z","fixes":[{"ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","fixed_in":["5.4.10","5.3.12.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.12.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.12.1"}]}]}],"products":[{"vendor":"ez","product":"ez_publish"}],"references":[{"url":"http://share.ez.no/community-project/security-advisories/ezsa-2017-005-xss-issue-in-search","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000431","tags":["advisory"]},{"url":"https://github.com/ezsystems/ezpublish-legacy/commit/c7174295fa0b9bd81bd4af908082464b0b80f278","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/CVE-2017-1000431.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20210408035246/http://share.ez.no/community-project/security-advisories/ezsa-2017-005-xss-issue-in-search","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m98q-p5gq-q5ff"}],"sources":{"cve":[{"id":"CVE-2017-1000431","description":"eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.","status":"published","published":"2018-01-02T20:00:00Z","modified":"2024-09-17T02:32:00.162Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2022-4533","description":"eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.","status":"published","published":"2018-01-02T20:00:00Z","modified":"2024-09-17T02:32:00Z","updated_at":"2026-11-03T00:28:39.580336Z"}],"ghsa":[{"id":"GHSA-m98q-p5gq-q5ff","title":"eZ Publish Cross-site Scripting (XSS) vulnerability","description":"eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12.0 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.","status":"published","published":"2022-05-14T03:49:37Z","modified":"2024-04-25T20:58:28Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:46.667202Z"}],"nvd":[{"id":"CVE-2017-1000431","description":"eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.","status":"published","published":"2018-01-02T20:29:00.36Z","modified":"2026-06-17T00:59:10.01Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"GHSA-m98q-p5gq-q5ff","title":"eZ Publish Cross-site Scripting (XSS) vulnerability","description":"eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12.0 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.","status":"published","published":"2022-05-14T03:49:37Z","modified":"2024-04-25T21:12:10.664653Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.463834Z"}]}}