A vulnerability has been reported in eZ Publish, which can be exploited by malicious users to bypass certain security restrictions.

The vulnerability is caused due to an error within the handling of block items in the eZ Flow extension and can be exploited to e.g. read protected content or change the order of blocks.

Successful exploitation requires access to the eZ Flow functionality.

The vulnerability is reported in eZ Flow extension versions 2.0, 2.1, 2.2, 2.3, and 2.4.

Solution
Apply update.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Yann Michard, Oppida.

Original Advisory
http://share.ez.no/community-project/security-advisories/ezsa-2012-005-block-handling-access-check-issue-in-ezflow-extension

Deep Links
Links available to Secunia VIM customers