GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-64vj-933f-6pm3highNo CVE assigned

eZ Platform Object Injection in SiteAccessMatchListener

Impact

This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.

Source excerpt · OSV

What to do

Update: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers.

OSV guidance

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

ezsystems/ezpublish-kernel Packagist
Affected rangeRecorded fix
From 7.5.0 before 7.5.8Ecosystem versions7.5.8
From 6.13.0 before 6.13.6.4Ecosystem versions6.13.6.4
From 5.4.0 before 5.4.15Ecosystem versions5.4.15

Version evidence: OSV · GHSA-64vj-933f-6pm3

View original version evidence (33 explicit versions)

Original source description

This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.

Update: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.

References