GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
GHSA-82rv-45pc-v28whigh

eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities

No CVE assignedCheck your stack

The advisory, in context

This security advisory fixes 4 separate vulnerabilities in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy by itself or via the LegacyBridge.

First, it increases the randomness, and thus the security, of the pseudo-random bytes used to generate a hash for the "forgot password" feature. This protects accounts against being taken over through attacks trying to predict the hash. If the increased randomness is not available in your PHP installation, it will now log a warning.

Second, it improves security of the information collector feature, by ensuring no collection emails will be sent from invalid manipulated forms.

Third, it stops the possible leaking of the names of content objects that should not be readable for certain users, on installations where these users can create or edit XML text.

Fourth, it protects against cross-site scripting (XSS) in the Matrix data type, on installations where users are allowed to edit content classes / content types.

We recommend that you install the security update as soon as possible.

To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply these patches manually: https://github.com/ezsystems/ezpublish-legacy/commit/917711eb7ffe2b52a3e9fe12505f6810a63696f7 https://github.com/ezsystems/ezpublish-legacy/commit/6db0e6b7739481f27d954548388bd3f0ed2c6fdd https://github.com/ezsystems/ezpublish-legacy/commit/efcd2b61b15eaaf74e0ff28d6c723cf28e655dab https://github.com/ezsystems/ezpublish-legacy/commit/f9ffaf590b63b4f552142cfd4441afbbfb3f19b1

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Ecosystem versions

From 2011.0.0 before 2017.12.2.1

Fixed in 2017.12.2.1

36 explicitly affected versions

2013.04.0, v2013.05.0, v2013.06.0, v2013.07.0, v2013.07.1, v2013.07.3, v2013.09.0, v2013.11, v2014.01.0, v2014.01.1, v2014.01.2, v2014.03.1, v2014.03.2, v2014.05.0, v2014.05.1, v2014.05.2, v2014.07.0, v2014.07.1, v2014.07.2, v2014.11.0, v2014.11.1, v2014.11.2, v2015.01.0, v2015.01.1, v2015.01.2, v2015.01.3, v2017.08.0, v2017.08.1, v2017.08.1.1, v2017.10.0, v2017.10.0-RC1, v2017.10.1, v2017.12.0, v2017.12.1, v2017.12.1.1, v2017.12.2

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2011.0.0"
        },
        {
          "fixed": "2017.12.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2013.04.0",
    "v2013.05.0",
    "v2013.06.0",
    "v2013.07.0",
    "v2013.07.1",
    "v2013.07.3",
    "v2013.09.0",
    "v2013.11",
    "v2014.01.0",
    "v2014.01.1",
    "v2014.01.2",
    "v2014.03.1",
    "v2014.03.2",
    "v2014.05.0",
    "v2014.05.1",
    "v2014.05.2",
    "v2014.07.0",
    "v2014.07.1",
    "v2014.07.2",
    "v2014.11.0",
    "v2014.11.1",
    "v2014.11.2",
    "v2015.01.0",
    "v2015.01.1",
    "v2015.01.2",
    "v2015.01.3",
    "v2017.08.0",
    "v2017.08.1",
    "v2017.08.1.1",
    "v2017.10.0",
    "v2017.10.0-RC1",
    "v2017.10.1",
    "v2017.12.0",
    "v2017.12.1",
    "v2017.12.1.1",
    "v2017.12.2"
  ]
}
Ecosystem versions

From 5.4.0 before 5.4.11.3

Fixed in 5.4.11.3

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.4.0"
        },
        {
          "fixed": "5.4.11.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": []
}
Ecosystem versions

From 5.3.0 before 5.3.12.3

Fixed in 5.3.12.3

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.3.0"
        },
        {
          "fixed": "5.3.12.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": []
}

References