CVE-2022-25336 Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel
Attackers can access unauthorized image files by deducing predictable paths and filenames in Ibexa DXP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25336?
CVE-2022-25336 is a medium-severity vulnerability in n/a, published on 18 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.
Weakness: CWE-639
Which versions are affected by CVE-2022-25336?
2 open source packages ship an affected version, including ezsystems/ezplatform-kernel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ezsystems/ezplatform-kernel Packagist | From 1.3.0 | 1.3.12 |
ezsystems/ezplatform-kernel Packagist | From 1.3.0 | 1.3.12 |
Products include Ibexa Ez Platform Kernel.
How do I fix CVE-2022-25336?
Upgrade ezsystems/ezplatform-kernel to 1.3.12 or later.
Is CVE-2022-25336 being exploited?
There is no known exploitation of CVE-2022-25336 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x8xx-x82q-42q3.