The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ez_publish | Ez | * | 3.8.8 (including) |
| Ez_publish | Ez | 3.9.0 (including) | 3.9.0 (including) |
| Ez_publish | Ez | 3.9.1 (including) | 3.9.1 (including) |
| Ez_publish | Ez | 3.9.2 (including) | 3.9.2 (including) |