{"id":"GHSA-64vj-933f-6pm3","aliases":[],"status":"published","title":"eZ Platform Object Injection in SiteAccessMatchListener","description":"This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-05-15T21:28:27Z","modified":"2024-11-29T05:40:36Z","fixes":[{"ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","fixed_in":["7.5.8","6.13.6.4","5.4.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.0"},{"fixed":"7.5.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.13.6.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.15"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.0"},{"fixed":"7.5.8"}]}],"versions":["v7.5.0","v7.5.1","v7.5.2","v7.5.3","v7.5.4","v7.5.5","v7.5.6","v7.5.6-rc1","v7.5.6.2","v7.5.7","v7.5.7-rc1","v7.5.7.1"]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.13.6.4"}]}],"versions":["v6.13.0","v6.13.0.1","v6.13.1","v6.13.1-rc1","v6.13.1.1","v6.13.1.2","v6.13.2","v6.13.2-beta1","v6.13.2-rc1","v6.13.3","v6.13.3-beta1","v6.13.3-rc1","v6.13.4","v6.13.4-beta1","v6.13.4-rc1","v6.13.5","v6.13.5.1","v6.13.6","v6.13.6-rc1","v6.13.6.2","v6.13.6.3"]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.15"}]}]}],"references":[{"url":"https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-kernel/2020-05-20-1.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-64vj-933f-6pm3"},{"url":"https://github.com/ezsystems/ezpublish-kernel","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-64vj-933f-6pm3","title":"eZ Platform Object Injection in SiteAccessMatchListener","description":"This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.","status":"published","published":"2024-05-15T21:28:27Z","modified":"2024-05-15T21:28:27Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:49.48194Z"}],"osv":[{"id":"GHSA-64vj-933f-6pm3","title":"eZ Platform Object Injection in SiteAccessMatchListener","description":"This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.","status":"published","published":"2024-05-15T21:28:27Z","modified":"2024-11-29T05:40:36.957136Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:39.266402Z"}]}}