Object Injection was found in legacy shop module (ezsystems/ezpublish-legacy) before versions v2019.03.5.1, v2017.12.7.3, and v5.4.14.2. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why we've classified it as Medium severity.