CVE-2005-4852

Name: CVE-2005-4852
Creator: NVD / NIST
Published: 2005-12-31T05:00:00+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.15%

Last modified Jun 16, 2026

CVE-2005-4852 is a vulnerability of currently unknown severity. The siteaccess URIMatching implementation in eZ publish 3.5 through 3.8 before 20050812 converts all non-alphanumeric characters in a URI to '_' (underscore), which allows remote attackers to bypass access restrictions by inserting certain characters in a URI, as demonstrated by a request for /admin:de, which matches a rule allowing only /admin_de to access /admin.. EPSS estimates a 1.15% chance of exploitation in the next 30 days.

Description

The siteaccess URIMatching implementation in eZ publish 3.5 through 3.8 before 20050812 converts all non-alphanumeric characters in a URI to '_' (underscore), which allows remote attackers to bypass access restrictions by inserting certain characters in a URI, as demonstrated by a request for /admin:de, which matches a rule allowing only /admin_de to access /admin.

Metrics

EPSS Probability

1.15%

62.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-264

Affected Software

Vendor	Product	Versions
Ez	Ez Publish	>= 3.5.0, < 3.5.8

References

http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0Vendor Advisory
http://issues.ez.no/7025Broken Link, Vendor Advisory
http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0Vendor Advisory
http://issues.ez.no/7025Broken Link, Vendor Advisory

Timeline

Published: Dec 31, 2005
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2005-4852?

How severe is CVE-2005-4852?

Severity scoring for CVE-2005-4852 is pending analysis. The EPSS model estimates a 1.15% probability of exploitation in the next 30 days.

How do I fix CVE-2005-4852?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2005-4852?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST