Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

eZ Platform Admin UI allows attackers to inject malicious code

published 2 years ago
Summary

The eZ Platform Admin UI has a security flaw that lets hackers inject malicious code into websites. This can happen if user-generated content is allowed on the site. To fix it, update the Admin UI using Composer to the latest version as soon as possible.

What to do
  • Update ezsystems ezplatform-admin-ui to version 1.3.5.
  • Update ezsystems ezplatform-admin-ui to version 1.4.4.
Affected software
Ecosystem VendorProductAffected versions
composer ezsystems ezplatform-admin-ui >= 1.3.0, < 1.3.5
>= 1.4.0, < 1.4.4
Fix: upgrade to 1.3.5
Original advisory text
eZ Platform Admin UI Cross-site Scripting vulnerability
This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds the necessary escaping of injected code. This resolves the issue both for code that has already been injected, and any future such code.

To install, use Composer to update "ezsystems/ezplatform-admin-ui" and "ezsystems/ezplatform-page-builder" to one of the "Resolving versions" mentioned above. (ezplatform-page-builder exists only in eZ Platform Enterprise Edition.)
References
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-q73v-79x3-jv2w · GHSA
Track software like this
Free during beta