{"id":"GHSA-2w9p-xxqr-h253","aliases":[],"status":"published","title":"eZ Platform Object Injection in SiteAccessMatchListener","description":"This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-05-15T21:14:18Z","modified":"2024-11-29T05:40:05Z","fixes":[{"ecosystem":"Packagist","package":"ezsystems/ezplatform-kernel","fixed_in":["1.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezplatform-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezplatform-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.3"}]}],"versions":["v1.0.0","v1.0.1","v1.0.1.1","v1.0.2","v1.0.2.1"]}],"references":[{"url":"https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-kernel/2020-05-20-1.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20201024030303/https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2w9p-xxqr-h253"},{"url":"https://github.com/ezsystems/ezplatform-kernel","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2w9p-xxqr-h253","title":"eZ Platform Object Injection in SiteAccessMatchListener","description":"This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.","status":"published","published":"2024-05-15T21:14:18Z","modified":"2024-05-15T21:14:24Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:49.48194Z"}],"osv":[{"id":"GHSA-2w9p-xxqr-h253","title":"eZ Platform Object Injection in SiteAccessMatchListener","description":"This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.","status":"published","published":"2024-05-15T21:14:18Z","modified":"2024-11-29T05:40:05.054112Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}