CVE-2005-4851: eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows re...

Security readout for executives and security teams

This flaw can let a logged-in eZ publish user read embedded objects they should not be allowed to access. The business risk is unauthorized disclosure of restricted CMS content, especially where authenticated users include customers, partners, or low-privilege staff. Exposure is limited to deployments running eZ publish 3.4.4 through 3.7 builds before 2005-07-22, with authenticated users who can reach content containing embedded XML-field objects. Treat as a targeted confidentiality issue. Prioritize if the CMS still hosts restricted content or has many external authenticated users. If no affected eZ publish instance exists, no action is needed beyond documentation. Mitigation focus: Identify any eZ publish 3.4.4 through 3.7 installations.; Check vendor changelog and issue 6841 for fixed-release guidance.; Upgrade vulnerable pre-20050722 builds according to vendor guidance..

Prepared

Jun 29, 2026, 04:47 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.