Vulnerability Description
eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows remote authenticated users to bypass the original permissions on embedded objects in XML fields and read these objects.
CVSS Score
4.0
MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ez | Ez Publish | >= 3.4.4, <= 3.7 |
Related Weaknesses (CWE)
References
- http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_xProduct
- http://issues.ez.no/6841Broken Link
- http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_xProduct
- http://issues.ez.no/6841Broken Link
FAQ
What is CVE-2005-4851?
CVE-2005-4851 is a vulnerability with a CVSS score of 4.0 (MEDIUM). eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows remote authenticated users to bypass the original permissions on embedded objects in XML fields...
How severe is CVE-2005-4851?
CVE-2005-4851 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-4851?
Check the references section above for vendor advisories and patch information. Affected products include: Ez Ez Publish.