CVE-2015-10071
Published:January 19, 2023
Updated:May 17, 2026
A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 5908d5ee65fec61ce0e321d586530461a210bf2a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218951.
Affected Packages
mugoweb/ezpublish-legacy (PHP):
Affected version(s) >=v2015.01.0 <v2015.01.3Fix Suggestion:
Update to version v2015.01.3ezsystems/ezpublish-legacy (PHP):
Affected version(s) >=2012.9 <2017.12.x-devFix Suggestion:
Update to version 2017.12.x-devmugoweb/ezpublish-legacy (PHP):
Affected version(s) >=dev-fix_EZP-21913_globalUsageScripts <dev-Issue/EZP-25301Fix Suggestion:
Update to version dev-Issue/EZP-25301mugoweb/ezpublish-legacy (PHP):
Affected version(s) >=v2014.01.0 <v2014.11.2Fix Suggestion:
Update to version v2014.11.2se7enxweb/ezpublish (PHP):
Affected version(s) =2013.04.0 <2023.12.x-devFix Suggestion:
Update to version 2023.12.x-devdatafactory/ezpublish-legacy (PHP):
Affected version(s) >=v2014.01.0 <v2017.07.1Fix Suggestion:
Update to version v2017.07.1mugoweb/ezpublish-legacy (PHP):
Affected version(s) =dev-batch-move-optimization <dev-better_urlencodeFix Suggestion:
Update to version dev-better_urlencodese7enxweb/ezpublish (PHP):
Affected version(s) >=v2015.01.0 <v2015.01.3Fix Suggestion:
Update to version v2015.01.3crevillo/ez-price-bundle (PHP):
Affected version(s) =dev-ez5 <dev-dev-ezp7Fix Suggestion:
Update to version dev-dev-ezp7mugoweb/ezpublish-legacy (PHP):
Affected version(s) >=2012.9 <2.9-3@426Fix Suggestion:
Update to version 2.9-3@426ezsystems/ezpublish-legacy (PHP):
Affected version(s) >=v2014.01.0 <v2014.11.2Fix Suggestion:
Update to version v2014.11.2datafactory/ezpublish-legacy (PHP):
Affected version(s) >=2012.9 <2.9-3@426Fix Suggestion:
Update to version 2.9-3@426netgen/ezpublish-legacy (PHP):
Affected version(s) >=v2015.01.0 <v2015.01.3Fix Suggestion:
Update to version v2015.01.3ezsystems/ezpublish-legacy (PHP):
Affected version(s) =dev-fix_EZP-21913_globalUsageScriptsFix Suggestion:
Update to version no_fixnetgen/ezpublish-legacy (PHP):
Affected version(s) >=v2014.01.0 <v2014.11.2Fix Suggestion:
Update to version v2014.11.2ezsystems/ezpublish-legacy (PHP):
Affected version(s) >=v2015.01.0 <v2015.01.3Fix Suggestion:
Update to version v2015.01.3mugoweb/ezpublish-legacy (PHP):
Affected version(s) =dev-configurable_dfs_backend <dev-custom_object_namesFix Suggestion:
Update to version dev-custom_object_namesse7enxweb/ezpublish (PHP):
Affected version(s) >=v2013.05.0 <v2014.11.2Fix Suggestion:
Update to version v2014.11.2netgen/ezpublish-legacy (PHP):
Affected version(s) >=v2013.04.0 <v2013.11Fix Suggestion:
Update to version v2013.11mugoweb/ezpublish-legacy (PHP):
Affected version(s) =dev-EZP-108.clean <dev-202308_808-migrate_the_code_to_display_the_trashed_date_in_the_admin_interfaceFix Suggestion:
Update to version dev-202308_808-migrate_the_code_to_display_the_trashed_date_in_the_admin_interfacemugoweb/ezpublish-legacy (PHP):
Affected version(s) >=v2013.04.0 <v2013.11Fix Suggestion:
Update to version v2013.11netgen/ezpublish-legacy (PHP):
Affected version(s) >=2012.9 <2023.12.01Fix Suggestion:
Update to version 2023.12.01Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
2.1
Attack Vector
ADJACENT
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
2.6
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Weak Password Recovery Mechanism for Forgotten Password
EPSS
Base Score:
0.25