CVE-2019-12139

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-16 · updated 2026-06-17
Weakness: CWE-79

Description

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4.

Affected products

Ezplatform-Admin-Ui: from 1.3.0 before 1.3.5; from 1.4.0 before 1.4.4 — fixed in 1.3.5, 1.4.4
Ezplatform-Page-Builder: from 1.1.0 before 1.1.5; from 1.2.0 before 1.2.4 — fixed in 1.1.5, 1.2.4

How to fix

Upgrade to a fixed version: Ezplatform-Admin-Ui 1.3.5, 1.4.4; Ezplatform-Page-Builder 1.1.5, 1.2.4. Check the vendor advisory for mitigations.

References

https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui
https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui

Get alerted when CVE-2019-12139 or the next vulnerability affects your stack