CVE-2007-4493 eZ publish before 3.8.9, and 3.9 before 3.9.3, does not properly check permissions on module views that lack a policy function, which has unknown impact and attack vectors, as demonstrated by a vulner...
HighCVSS 10.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
eZ publish before 3.8.9, and 3.9 before 3.9.3, does not properly check permissions on module views that lack a policy function, which has unknown impact and attack vectors, as demonstrated by a vulnerability in the discount functionality in the shop module.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ez publish | <= 3.8.8 | No fix listed |
| ez publish | = 3.9.0 | No fix listed |
| ez publish | = 3.9.1 | No fix listed |
| ez publish | = 3.9.2 | No fix listed |