CVE-2005-4855

published 2005-12-31

CVE-2005-4855: Unrestricted file upload vulnerability in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050922 does not restrict Image…

Priority P4 12 low 3.5 CVSS 2.0

AV N AC M Au S C N I P A N

Unrestricted file upload vulnerability in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050922 does not restrict Image datatype uploads to image content types, which allows remote authenticated users to upload certain types of files, as demonstrated by .js files, which may enable cross-site scripting (XSS) attacks or other attacks.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
ez	ez_publish	—	—
ez	ez_publish	—	—
ez	ez_publish	>= 3.5.0 < 3.5.5	3.5.5
ez	ez_publish	>= 3.6.0 < 3.6.2	3.6.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264