What’s Vulnerable › Vulnerabilities

CVE-2021-46875

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-12 · updated 2026-06-17
• Weakness: CWE-79

Description

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.

Affected products

• ibexa Ez Platform Kernel: from 1.2.0 before 1.2.5.1; from 1.3.0 before 1.3.1.1; from 6.13.0 before 6.13.8.2; from 7.5.0 before 7.5.15.2 — fixed in 1.2.5.1, 1.3.1.1, 6.13.8.2, 7.5.15.2

How to fix

Upgrade to a fixed version: ibexa Ez Platform Kernel 1.2.5.1, 1.3.1.1, 6.13.8.2, 7.5.15.2. Check the vendor advisory for mitigations.

References

• https://github.com/ezsystems/ezpublish-kernel/commit/29fecd2afe86f763510f10c02f14962d028f311b
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-mrvj-7q4f-5p42
• https://github.com/ezsystems/ezpublish-kernel/commit/29fecd2afe86f763510f10c02f14962d028f311b
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-mrvj-7q4f-5p42

Get alerted when CVE-2021-46875 or the next vulnerability affects your stack