Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

ezsystems/ezfind-ls

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    Cross-site Scripting in eZFind spellcheck

    GHSA-9cq2-pcgr-8h62

    Affected
    • Packagist ezsystems/ezfind-ls >= 2017.12.0, < 2017.12.0.1; >= 5.4.0, < 5.4.11.1; >= 5.3.0, < 5.3.6.1
    Fixed in
    5.4.11.12017.12.0.15.3.6.1· Vendor fix available
    Issue
    This security advisory fixes a vulnerability in the legacy eZ Find extension, which can be used with the LegacyBridge in eZ Platform. It affects sites using the "Did you mean...?" spell check / search suggestion feature. This feature is vulnerable to Cross-site Scripting (XSS) injection (reflected XSS). The update adds the necessary escaping of injected code. If you're affected, we recommend that you install it as soon as possible. If you have custom search templates, please make sure you update these as well. Ensure that "searchextras.spellcheckcollation" is followed by the "wash" operator, like this: {$searchextras.spellcheckcollation|wash} To install, use Composer to update to one of the "Resolving versions" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezfind/commit/51c17ea9b1231c20db8221f34d01c649060f1e91

    Recommended action: Upgrade to 2017.12.0.1, 5.4.11.1 or 5.3.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →