eZ publish 3.5 through 3.7 before 20050830 does not use a folder's read permissions to restrict notifications, which allows remote authenticated users to obtain sensitive information about changes to content in arbitrary folders.
References
Configurations
Configuration 1 (hide)
|
Information
Published : 2005-12-30 21:00
Updated : 2015-07-28 07:55
NVD link : CVE-2005-4854
Mitre link : CVE-2005-4854
JSON object : View
CWE
CWE-264
Permissions, Privileges, and Access Controls
Products Affected
ez
- ez_publish