Vulnerability in Ez Publish
CVE-2008-6844
The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters.
EPSS: 0.030 (85.8th percentile) — read the EPSS interpretation.
Affected products
- Ez Ez_publish — versions 3.4.8, 3.5.4, 3.5.5
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
Frequently asked questions
- What is CVE-2008-6844?
- CVE-2008-6844 is a vulnerability in Ez Publish, classified under CWE-264. Published 2009-07-02.
- Is CVE-2008-6844 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.