Cloud Vulnerability DB
A community-led vulnerabilities database
Introducing Wiz for Exposure Management: Unify, prioritize, and remediate exposures everywhere.
Vulnerability DatabaseGHSA-64vj-933f-6pm3
GHSA-64vj-933f-6pm3:
PHP vulnerability analysis and mitigation
Overview
The vulnerability (GHSA-64vj-933f-6pm3) is an object injection vulnerability discovered in the SiteAccessMatchListener component of eZ Platform. The issue was disclosed on May 20, 2020, affecting multiple versions of ezsystems/ezplatform-kernel and ezsystems/ezpublish-kernel packages. The vulnerability impacts all versions from 5.4.0 through 7.5.7.1 of the affected packages (EZ Platform).
Technical details
The vulnerability is classified as a high-severity object injection flaw in the SiteAccessMatchListener component that could potentially lead to remote code execution (RCE). The initial fix for this vulnerability introduced some bugs, particularly affecting compound siteaccess matchers, which required subsequent patches. The issue has been assigned CWE-94 (Code Injection) classification (GitHub Advisory).
Impact
The vulnerability poses a serious security threat as it could enable remote code execution (RCE) on affected systems. All sites running the vulnerable versions of eZ Platform were potentially affected by this security issue (EZ Platform).
Mitigation and workarounds
The vulnerability has been patched in multiple versions: ezsystems/ezplatform-kernel v1.0.3, ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15. Users are strongly advised to upgrade to these patched versions. The security updates are distributed via Composer (EZ Platform).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management