{"id":"GHSA-39j2-4p9j-5w4j","aliases":[],"status":"published","title":"Ez Platform Object Injection in legacy shop module","description":"This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-05-15T21:32:29Z","modified":"2024-11-29T05:26:35Z","fixes":[{"ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","fixed_in":["2019.3.5.1","2017.12.7.3","5.4.14.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2019.3.0"},{"fixed":"2019.3.5.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.12.0"},{"fixed":"2017.12.7.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.14.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2019.3.0"},{"fixed":"2019.3.5.1"}]}],"versions":["v2019.03.0","v2019.03.1","v2019.03.2","v2019.03.3","v2019.03.4","v2019.03.4.2","v2019.03.5"]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2017.12.0"},{"fixed":"2017.12.7.3"}]}],"versions":["v2017.12.0","v2017.12.1","v2017.12.1.1","v2017.12.2","v2017.12.2.1","v2017.12.2.2","v2017.12.3","v2017.12.3.1","v2017.12.3.2","v2017.12.4","v2017.12.4.1","v2017.12.4.2","v2017.12.4.3","v2017.12.5","v2017.12.6","v2017.12.7","v2017.12.7.2"]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.14.2"}]}]}],"references":[{"url":"https://ezplatform.com/security-advisories/ibexa-sa-2020-006-object-injection-in-legacy-shop-module","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2020-10-05-1.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-39j2-4p9j-5w4j"},{"url":"https://github.com/ezsystems/ezpublish-legacy","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-39j2-4p9j-5w4j","title":"Ez Platform Object Injection in legacy shop module","description":"This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.","status":"published","published":"2024-05-15T21:32:29Z","modified":"2024-05-15T21:32:30Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:49.987036Z"}],"osv":[{"id":"GHSA-39j2-4p9j-5w4j","title":"Ez Platform Object Injection in legacy shop module","description":"This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.","status":"published","published":"2024-05-15T21:32:29Z","modified":"2024-11-29T05:26:35.611726Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}