CVE-2022-48367 Object state limitation has no effect
Attackers can bypass access controls based on object state in Ibexa Kernel, potentially accessing unauthorized content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48367?
CVE-2022-48367 is a critical missing authorization vulnerability in n/a, published on 12 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
Weakness: CWE-862
Which versions are affected by CVE-2022-48367?
4 open source packages ship an affected version, including ezsystems/ezpublish-kernel. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
ezsystems/ezpublish-kernel Packagist | From 7.5.0 | 7.5.28 |
ezsystems/ezpublish-kernel Packagist | From 7.5.0 | 7.5.28 |
ezsystems/ezpublish-kernel Packagist | From 7.5.0 | 7.5.28 |
ezsystems/ezpublish-kernel Packagist | From 7.5.0 | 7.5.28 |
Products include Ibexa Digital Experience Platform, Ibexa Ez Platform Kernel, Ibexa Ezplatform-Http-Cache-Fastly, Ibexa Fastly, Ibexa Kernel.
How do I fix CVE-2022-48367?
Upgrade ezsystems/ezpublish-kernel to 7.5.28 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-48367 being exploited?
There is no known exploitation of CVE-2022-48367 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5x4f-7xgq-r42x, GHSA-h5v2-wrhp-5v35.