Unrated severityNVD Advisory· Published Jul 2, 2009· Updated Apr 23, 2026
CVE-2008-6844
CVE-2008-6844
Description
The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters.
Affected products
24cpe:2.3:a:ez:ez_publish:*:*:*:*:*:*:*:*+ 23 more
- cpe:2.3:a:ez:ez_publish:*:*:*:*:*:*:*:*range: <=3.5.6
- cpe:2.3:a:ez:ez_publish:3.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.8.9:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:3.10:*:*:*:*:*:*:*
- cpe:2.3:a:ez:ez_publish:4.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- www.securityfocus.com/bid/32762nvdExploit
- ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possiblenvdVendor Advisory
- www.osvdb.org/52708nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/47216nvd
- www.exploit-db.com/exploits/7406nvd
News mentions
0No linked articles in our index yet.