CVE-2019-12139

Name of the Vulnerable Software and Affected Versions ezplatform-admin-ui versions 1.3.x through 1.3.4 ezplatform-admin-ui versions 1.4.x through 1.4.3 ezplatform-page-builder versions 1.1.x through 1.1.4 ezplatform-page-builder versions 1.2.x through 1.2.3

Description A security issue was discovered in the Admin UI of eZ Platform, affecting versions 2.x. This issue allows for XSS injection, particularly in sites that allow user-generated content. The necessary update adds escaping of injected code, resolving the issue for both existing and future injected code.

Recommendations For ezplatform-admin-ui versions 1.3.x through 1.3.4, update to version 1.3.5 or later using Composer. For ezplatform-admin-ui versions 1.4.x through 1.4.3, update to version 1.4.4 or later using Composer. For ezplatform-page-builder versions 1.1.x through 1.1.4, update to version 1.1.5 or later using Composer. For ezplatform-page-builder versions 1.2.x through 1.2.3, update to version 1.2.4 or later using Composer.