Read the docs
TI-2021-22711 Aliases GHSA-jpwx-ffjq-wr4w

Content object state fetch functions open to SQL injection

Priority LOW 38CWE-89Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
SQL injection
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-89.

Summary

### Impact This Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible. ### Patches The fix is distributed via Composer, see "Patched versions".

Why it matters now

Fix Fixed ezsystems/ezpublish-legacy (Packagist): 2019.03.6.1, 2017.12.7.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ezsystems/ezpublish-legacy (Packagist)2018.06.0 to before 2019.03.6.12019.03.6.1Patch availableGHSA-jpwx-ffjq-wr4w
—ezsystems/ezpublish-legacy (Packagist)before 2017.12.7.42017.12.7.4Patch availableGHSA-jpwx-ffjq-wr4w
  • ezsystems/ezpublish-legacy (Packagist) Vendor— Affected 2018.06.0 to before 2019.03.6.1 Fixed in 2019.03.6.1 Patch available GHSA-jpwx-ffjq-wr4w
  • ezsystems/ezpublish-legacy (Packagist) Vendor— Affected before 2017.12.7.4 Fixed in 2017.12.7.4 Patch available GHSA-jpwx-ffjq-wr4w

Remediation

  • Fix · GHSA-jpwx-ffjq-wr4w ezsystems/ezpublish-legacy (Packagist) Fixed in 2019.03.6.1 Advisory →
  • Fix · GHSA-jpwx-ffjq-wr4w ezsystems/ezpublish-legacy (Packagist) Fixed in 2017.12.7.4 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-jpwx-ffjq-wr4w

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences