PT-2023-11639 · Ez Systems · Ez Publish Platform+1
CVE-2020-23065
·
Publicado
2023-06-26
·
Atualizado
2023-07-04
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
eZ Systems AS eZPublish Platform version 5.4
eZ Publish Legacy version 5.4
Description
The issue allows a remote authenticated attacker to execute arbitrary code via the video-js.swf, which is a Cross Site Scripting vulnerability. This enables the attacker to perform actions on the web application that they would not normally be allowed to do.
Recommendations
For eZ Systems AS eZPublish Platform version 5.4, consider disabling the video-js.swf file until a patch is available.
For eZ Publish Legacy version 5.4, restrict access to the video-js.swf file to minimize the risk of exploitation.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ez Publish Legacy
Ez Publish Platform