eZ Platform Admin UI Cross-site Scripting vulnerability
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds the necessary escaping of injected code. This resolves the issue both for code that has already been injected, and any future such code. To install, use Composer to update "ezsystems/ezplatform-admin-ui" and "ezsystems/ezplatform-page-builder" to one of the "Resolving versions" mentioned above. (ezplatform-page-builder exists only in eZ Platform Enterprise Edition.)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ezsystems/ezplatform-admin-ui (Packagist) | 1.3.0 to before 1.3.5 | 1.3.5 | Patch available | GHSA-q73v-79x3-jv2w |
| — | ezsystems/ezplatform-admin-ui (Packagist) | 1.4.0 to before 1.4.4 | 1.4.4 | Patch available | GHSA-q73v-79x3-jv2w |
- ezsystems/ezplatform-admin-ui (Packagist) Vendor— Affected 1.3.0 to before 1.3.5 Fixed in 1.3.5 Patch available GHSA-q73v-79x3-jv2w
- ezsystems/ezplatform-admin-ui (Packagist) Vendor— Affected 1.4.0 to before 1.4.4 Fixed in 1.4.4 Patch available GHSA-q73v-79x3-jv2w
Remediation
- Fix · GHSA-q73v-79x3-jv2w ezsystems/ezplatform-admin-ui (Packagist) Fixed in 1.3.5 Advisory →
- Fix · GHSA-q73v-79x3-jv2w ezsystems/ezplatform-admin-ui (Packagist) Fixed in 1.4.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-q73v-79x3-jv2w
References
Other 4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-admin-ui/CVE-2019-12139.yaml
- https://github.com/ezsystems/ezplatform-admin-ui
- https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui
- https://web.archive.org/web/20201207160038/https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences