Excessive Privileges in Ibexa Kernel Admin Role Vulnerability
CVE-2022-48365

7.2HIGH

Key Information:

Vendor

Ibexa

Status
Digital Experience Platform
Ez Platform Kernel
Ez Platform
Vendor
CVE Published:
12 March 2023

What is CVE-2022-48365?

A vulnerability was identified in the eZ Platform Ibexa Kernel prior to version 1.3.26, where the Company admin role is granted excessive privileges. This misconfiguration can lead to unauthorized actions and potential exploitation, posing a risk to the security and integrity of the application. It is crucial for organizations using this platform to review their configurations and implement the latest updates to mitigate these risks effectively.

References

https://github.com/ezsystems/ezpublish-kernel/commit/957e...
https://developers.ibexa.co/security-advisories/ibexa-sa-...
https://github.com/ezsystems/ezpublish-kernel/security/ad...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.