CVE-2008-6844: Ez Publish

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters.

Affected products

• Ez Ez Publish: up to and including 3.5.6; version 3.4.8 only; version 3.5.4 only; version 3.5.5 only; version 3.5.7 only; version 3.5.8 only; …

Published 2009-07-02. Last modified 2026-06-16.