CVE-2005-4852 - CVE House
Back to Database
Status published Medium CVE-2005-4852

The siteaccess URIMatching implementation in eZ publish 3.5 through 3.8...

Vulnerability Description

The siteaccess URIMatching implementation in eZ publish 3.5 through 3.8 before 20050812 converts all non-alphanumeric characters in a URI to '_' (underscore), which allows remote attackers to bypass access restrictions by inserting certain characters in a URI, as demonstrated by a request for /admin:de, which matches a rule allowing only /admin_de to access /admin.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2005-4852

Credits & Attribution

No credits recorded in the NVD database.

References

More from ez

View All →
CVE-2020-10806
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x...
Critical 9.8
CVE-2019-12139
An XSS issue was discovered in the Admin UI in...
Medium 6.1
CVE-2017-1000431
eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12...
Medium 6.1
CVE-2012-4053
Cross-site request forgery (CSRF) vulnerability in eZOE flash player in...
Medium 6.8
CVE-2012-1597
Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php...
Low 2.6

Affected Vendor

Affected Software

ez publish
Vulnerable Versions:
3.5.0

Timeline

Official Publish: July 6th, 2007
Last Modified: September 17th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.