Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
eZ Platform Legacy eZ Find Extension Spellcheck Vulnerability
published 2 years ago
Summary
A security update is available for the eZ Platform Legacy eZ Find extension to prevent attackers from injecting malicious code into the spellcheck feature. This could allow them to take control of your website. To stay safe, update the extension as soon as possible, and ensure your custom search templates are also updated correctly.
What to do
- Update ezsystems ezfind-ls to version 2017.12.0.1.
- Update ezsystems ezfind-ls to version 5.4.11.1.
- Update ezsystems ezfind-ls to version 5.3.6.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | ezsystems | ezfind-ls |
>= 2017.12.0, < 2017.12.0.1 >= 5.4.0, < 5.4.11.1 >= 5.3.0, < 5.3.6.1 Fix: upgrade to 2017.12.0.1
|
Original advisory text
Cross-site Scripting in eZFind spellcheck
This security advisory fixes a vulnerability in the legacy eZ Find extension, which can be used with the LegacyBridge in eZ Platform. It affects sites using the "Did you mean...?" spell check / search suggestion feature. This feature is vulnerable to Cross-site Scripting (XSS) injection (reflected XSS). The update adds the necessary escaping of injected code. If you're affected, we recommend that you install it as soon as possible.
If you have custom search templates, please make sure you update these as well. Ensure that "search_extras.spellcheck_collation" is followed by the "wash" operator, like this:
{$search_extras.spellcheck_collation|wash}
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually:
https://github.com/ezsystems/ezfind/commit/51c17ea9b1231c20db8221f34d01c649060f1e91
If you have custom search templates, please make sure you update these as well. Ensure that "search_extras.spellcheck_collation" is followed by the "wash" operator, like this:
{$search_extras.spellcheck_collation|wash}
To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually:
https://github.com/ezsystems/ezfind/commit/51c17ea9b1231c20db8221f34d01c649060f1e91
References
- https://github.com/ezsystems/ezfind/commit/51c17ea9b1231c20db8221f34d01c649060f1...
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezfind...
- https://share.ez.no/community-project/security-advisories/ezsa-2019-003-xss-in-e...
- https://web.archive.org/web/20210614183107/https://share.ez.no/community-project...
- https://github.com/advisories/GHSA-9cq2-pcgr-8h62
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-9cq2-pcgr-8h62 · GHSA
Track software like this
Free during beta