Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-du7k-qt4g-v3de
Vulnerability ID VCID-du7k-qt4g-v3de
Aliases GHSA-64vj-933f-6pm3
Summary eZ Platform Object Injection in SiteAccessMatchListener
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual HIGH https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-64vj-933f-6pm3
generic_textual HIGH https://github.com/ezsystems/ezpublish-kernel
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-kernel/2020-05-20-1.yaml
Reference id Reference type URL
https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener
https://github.com/ezsystems/ezpublish-kernel
https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-kernel/2020-05-20-1.yaml
GHSA-64vj-933f-6pm3 https://github.com/advisories/GHSA-64vj-933f-6pm3
No exploits are available.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-11T20:34:48.863641+00:00 GHSA Importer Import https://github.com/advisories/GHSA-64vj-933f-6pm3 38.6.0