CVE-2022-48365 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.2 HIGH	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	7.2 HIGH	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 43%

Affected Products (NVD)

Vendor	Product	Version
ibexa	digital_experience_platform	3.3.0 ≤ 𝑥 < 3.3.28
ibexa	digital_experience_platform	4.2.0 ≤ 𝑥 < 4.2.3
ibexa	ez_platform	2.5.0 ≤ 𝑥 < 2.5.31
ibexa	ez_platform_kernel	1.3.0 ≤ 𝑥 < 1.3.26
ibexa	ez_platform_kernel	7.5.0 ≤ 𝑥 < 7.5.30

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-269 - Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References

https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips

https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp

https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779ab

https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7g

https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips

https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp

https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779ab

https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7g