Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2021-46875

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.

VectorNETWORK

PublishedMar 12, 2023, 05:15

Published Bycve@mitre.org

Base Score

Score6.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

ezsystems/ezpublish-kernel(Packagist)06.13.8.2N/A

ezsystems/ezpublish-kernel(Packagist)7.0.07.5.15.2N/A

ezsystems/ezplatform-kernel(Packagist)01.2.5.1N/A

ezsystems/ezplatform-kernel(Packagist)1.3.01.3.1.1N/A

References

https://github.com/ezsystems/ezpublish-kernel/commit/29fecd2afe86f763510f10c02f14962d028f311b
https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-mrvj-7q4f-5p42

Weakness Type

CWE-79

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK