GHSA-58h5-h554-429q json
ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS)
published 4y ago modified last yr.
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
It is possible to inject JavaScript XSS in the content type entries "name" and "short name". To exploit this, one must already have permission to edit content types, which limits it in many cases to people who are already administrators. However, please verify which users have this permission. The fix ensures any injections are escaped.
Patch / fix
- packagist ezsystems/ezplatform-admin-ui 2.3.26
Is GHSA-58h5-h554-429q in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | ezsystems/ezplatform-admin-ui | >=2.3.0, <2.3.26 |
2.3.26 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/ezsystems/ezplatform-admin-ui/commit/29e156a7bbecca5abd946c99546a261679587d29
web
-
github.com
/ezsystems/ezplatform-admin-ui/security/advisories/GHSA-58h5-h554-429q
web
-
developers.ibexa.co
/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-draf
web
-
github.com
/ezsystems/ezplatform-admin-ui
package
Sources
- GitHub Advisory GHSA-58h5-h554-429q
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.