Auth bypass in Ez Publish

CVE-2005-4851

eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows remote authenticated users to bypass the original permissions on embedded objects in XML fields and read these objects.

Vulnerability class: Broken Authentication

EPSS: 0.009 (55.3th percentile) — read the EPSS interpretation.

Affected products

Ez Ez_publish
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_CONFIRM, Product)
cve@mitre.org (x_refsource_CONFIRM, Broken Link)