Secunia

A vulnerability has been reported in eZ Publish, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the application not properly checking if the provided user ID value already exists during user registration. This can be exploited to modify existing users by providing an already existing user ID value.

This vulnerability is reported in version 3.5.6 and later.

Solution
Update to version 3.9.5, 3.10.1 or 4.0.1.

Provided and/or discovered by
s4avrd0w

Changelog
Further details available in Customer Area

Original Advisory
s4avrd0w:
http://milw0rm.com/exploits/7406

EZSA-2008-003:
http://ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible

Deep Links
Links available in Customer Area