GHSA-39j2-4p9j-5w4j Ez Platform Object Injection in legacy shop module

• Packagist ezsystems/ezpublish-legacy: >= 2019.3.0, < 2019.3.5.1 → fixed in 2019.3.5.1 • Packagist ezsystems/ezpublish-legacy: >= 2017.12.0, < 2017.12.7.3 → fixed in 2017.12.7.3 • Packagist ezsystems/ezpublish-legacy: >= 5.4.0, < 5.4.14.2 → fixed in 5.4.14.2

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.