CVE-2020-10806

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-10806

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10806.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-10806

Aliases

GHSA-54p5-gxq6-j98g

Published

2020-03-22T16:15:12.307Z

Modified

2026-07-08T05:54:17.761551196Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "fixed": "5.4.14.1"
                },
                {
                    "fixed": "5.4.14.1"
                }
            ],
            "cpes": [
                "cpe:2.3:a:ez:ez_publish-kernel:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "ez:ez_publish-kernel"
        },
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "fixed": "5.4.14.1"
                },
                {
                    "fixed": "5.4.14.1"
                },
                {
                    "introduced": "2017.0"
                },
                {
                    "fixed": "2017.12.7.2"
                }
            ],
            "cpes": [
                "cpe:2.3:a:ez:ez_publish-legacy:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "ez:ez_publish-legacy"
        }
    ]
}

References

https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads

Affected packages

Git / github.com/ezsystems/ezpublish-kernel

Affected ranges

Type

GIT

Repo

https://github.com/ezsystems/ezpublish-kernel

Events

Introduced

8e9532655327d4f7a36ca52e42b04087b03aaf63

Fixed

0ec4ce5265a289cf72ebe4629ca2ccbc84cb4176

Introduced

c10d6217b6daafa1032536c852dfe1c1acb49e5d

Fixed

296628934d22c427d97ad49f7b12149b51b5c4d2

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.13.6.2"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.5.6.2"
        }
    ],
    "cpe": "cpe:2.3:a:ez:ez_publish-kernel:*:*:*:*:*:*:*:*"
}

Affected versions

v6.*

v6.0.0

v6.1.0

v6.1.0-rc1

v6.10.0-beta1

v6.11.0-beta1

v6.12.0

v6.12.0-beta1

v6.12.0-beta2

v6.12.0-rc1

v6.13.0

v6.13.0-beta1

v6.13.0-beta2

v6.13.0-rc1

v6.13.1

v6.13.1-rc1

v6.13.2

v6.13.2-rc1

v6.13.3

v6.13.3-beta1

v6.13.3-rc1

v6.13.4

v6.13.4-beta1

v6.13.4-rc1

v6.13.6

v6.13.6-rc1

v6.2.0

v6.2.0-rc1

v6.2.0-rc2

v6.2.0-rc3

v6.2.0-rc4

v6.2.0-rc5

v6.3.0

v6.3.0-beta1

v6.3.0-rc1

v6.3.0-rc2

v6.3.0-rc3

v6.4.0

v6.4.0-beta1

v6.4.0-beta2

v6.4.0-rc1

v6.5.0

v6.5.0-beta1

v6.5.0-rc1

v6.5.0-rc2

v6.5.0-rc3

v6.6.0-beta1

v6.6.0-beta2

v6.6.0-rc1

v6.7.0

v6.7.0-beta1

v6.7.0-rc1

v6.8.0-beta1

v6.9.0

v6.9.0-beta1

v6.9.0-rc1

v7.*

v7.0.0-beta2

v7.1.0

v7.1.0-beta1

v7.1.0-beta2

v7.1.0-rc1

v7.1.0-rc2

v7.2.0

v7.2.0-beta1

v7.2.0-rc1

v7.2.1

v7.3.0

v7.3.0-beta1

v7.3.0-rc1

v7.3.0-rc2

v7.3.1

v7.4.0

v7.4.0-beta1

v7.4.0-rc1

v7.5.0-rc1

v7.5.0-rc2

v7.5.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10806.json"

Git / github.com/ezsystems/ezpublish-legacy

Affected ranges

Type

GIT

Repo

https://github.com/ezsystems/ezpublish-legacy

Events

Introduced

Fixed

5b398c582315141a50ea25044649997831fac4f4

Fixed

089617a2e2461d49b795a4104e0c7667fb0a4b94

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "2017.0"
        },
        {
            "fixed": "2017.12.7.2"
        },
        {
            "introduced": "2019.0"
        },
        {
            "fixed": "2019.03.4.2"
        }
    ],
    "cpe": "cpe:2.3:a:ez:ez_publish-legacy:*:*:*:*:*:*:*:*"
}

Affected versions

2011.*

2011.9

2012.*

2012.11

2012.12

2012.9

2013.*

2013.05

2013.1

v2013.*

v2013.06.0

v2013.07.0

v2013.07.1

v2013.07.3

v2013.09.0

v2013.11

v2013.11.0

v2014.*

v2014.01.0

v2014.01.1

v2014.03.1

v2014.05.0

v2014.07.0

v2015.*

v2015.01.0

v2015.01.1

v2017.*

v2017.08.1

v2017.08.1.1

v2017.10.0

v2017.10.0-RC1

v2017.10.1

v2017.12.0

v2017.12.1

v2017.12.1.1

v2017.12.2

v2017.12.2.1

v2017.12.3

v2017.12.3.1

v2017.12.3.2

v2017.12.4

v2017.12.4.1

v2017.12.4.2

v2017.12.4.3

v2017.12.5

v2017.12.6

v2017.12.7

v2018.*

v2018.06.0

v2018.06.1

v2018.06.1.1

v2019.*

v2019.03.0

v2019.03.0-rc1

v2019.03.0-rc2

v2019.03.1

v2019.03.2

v2019.03.3

v2019.03.4

v5.*

v5.1-ALPHA0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10806.json"