CVE-2007-4494: Ez Publish

Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days.

The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks.

Affected products

• Ez Ez Publish: up to and including 3.8.8; version 3.9.0 only; version 3.9.1 only; version 3.9.2 only

Published 2007-08-23. Last modified 2026-06-16.