-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform-richtext | composer | >= 2.3.0-beta1, < 2.3.26 | 2.3.26 |
Miggo AIRoot Cause AnalysisThe vulnerability is an XML External Entity (XXE) injection in the RichText field type. The provided commit (5ba2a82cc3aa6235ecfe87278e20c1451d9df913) shows changes primarily in src/lib/eZ/RichText/DOMDocumentFactory.php and the introduction of a new src/lib/RichText/XMLSanitizer.php.
The key change is within the DOMDocumentFactory::loadXMLString method. Before the patch, this method directly used loadXML with the LIBXML_NOENT flag on the user-supplied XML string. The LIBXML_NOENT flag instructs the XML parser to substitute entities, which is the entry point for XXE attacks if the XML is not properly sanitized. The patch introduces calls to XMLSanitizer::sanitizeXMLString and XMLSanitizer::convertCDATAToText before and after the loadXML call, respectively. This indicates that DOMDocumentFactory::loadXMLString was the function directly processing the malicious input and was vulnerable prior to these sanitization steps being added. The functions within XMLSanitizer are part of the mitigation, not the vulnerable functions themselves. The vulnerability existed in the loadXMLString method due to the lack of input sanitization before entity processing.
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report