p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in ezsystems/ezplatform-admin-ui

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für ezsystems/ezplatform-admin-ui: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 10

  1. GHSA-99c7-c3mw-mxhv

    Mittel · CVSS 4.8Korrektur verfügbar

    ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

    ### Impact This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. ### Patches See "Patched versions". ### Workarounds None. ### References https://developers.ibexa.co/sec

    ezsystems/ezplatform-admin-uiPHP
    • Auf 2.3.39 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. GHSA-r7pm-mw8g-p7px

    Mittel · CVSS 6.1Korrektur verfügbar

    Ibexa eZ Platform Admin UI XSS vulnerabilities in back office

    ### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. ### Patches - See "Patched versions". - https://github.com/ezsystems/ezplatform-admin-ui/commit/acaa620d4ef44e7c20908dc389d48064

    ezsystems/ezplatform-admin-uiPHP
    • Auf 2.3.38 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. GHSA-gc5h-6jx9-q2qh

    Mittel · CVSS 5.4Korrektur verfügbar

    eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

    ### Impact The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and administrators will have the required permission. It is not persistent, i.e. the payload is only executed during the upload. In effect, an attacker will have to trick an editor/administrator into uploading a strangely named file. The fix ensures XSS is escaped. ### Patches See "Patched versions". Commit: https://github.com/ezsystems/ezplatform-admin-ui/commit/7a9f991b200fa5a03d49cd07f50577c8bc90a30b ### Workarounds None. ### References - https://developers.ibexa.c

    ezsystems/ezplatform-admin-uiPHP
    • Auf 3.3.39 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. GHSA-q73v-79x3-jv2w

    Nicht bewertetKorrektur verfügbar

    eZ Platform Admin UI Cross-site Scripting vulnerability

    This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds the necessary escaping of injected code. This resolves the issue both for code that has already been injected, and any future such code. To install, use Composer to update "ezsystems/ezplatform-admin-ui" and "ezsystems/ezplatform-page-builder" to one of the "Resolving versions" mentioned above. (ezplatform-page-builder exists only in eZ Platform Enterp

    ezsystems/ezplatform-admin-ui ezsystems/ezplatform-admin-uiPHP
    • Auf 1.3.5 aktualisieren
    • Auf 1.4.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. GHSA-cg84-55jx-4237

    Nicht bewertetKorrektur verfügbar

    eZ Platform Password reset vulnerability

    This Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x. The functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other circumstances an attacker may exploit this to gain control over user accounts. The update ensures such an attack is exceedingly unlikely to succeed. You may want to consider a configuration change to further strengthen your security. By default a password reset request is valid for 1 hour. Reducing this time will make attacks even more difficult, but e

    ezsystems/ezplatform-admin-uiPHP
    • Auf 1.4.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. GHSA-pcpm-vc4v-cmvx

    Nicht bewertetKorrektur verfügbar

    eZ Platform users with the Company admin role can assign any role to any user

    Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.

    ezsystems/ezplatform-admin-ui ezsystems/ezplatform-admin-uiPHP
    • Auf 1.5.29 aktualisieren
    • Auf 2.3.26 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. GHSA-58h5-h554-429q

    Nicht bewertetKorrektur verfügbar

    ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS)

    It is possible to inject JavaScript XSS in the content type entries "name" and "short name". To exploit this, one must already have permission to edit content types, which limits it in many cases to people who are already administrators. However, please verify which users have this permission. The fix ensures any injections are escaped.

    ezsystems/ezplatform-admin-uiPHP
    • Auf 2.3.26 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. GHSA-6v6p-g8cg-2hgg

    Mittel · CVSS 5.3Korrektur verfügbar

    Improper Certificate Validation in node-sass affects eZ Platform

    Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects ezsystems/ezplatform and ezsystems/ezplatform-page-builder.

    ezsystems/ezplatform-admin-uiPHP
    • Auf 1.5.27 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. GHSA-9jp8-cwwx-p64q

    Nicht bewertetKorrektur verfügbar

    XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

    The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.

    ezsystems/ezplatform-admin-uiPHP
    • Auf 1.5.25.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →