PT-2023-33056 · Ibexa · Ibexa

Publicado 2023-05-10 · Atualizado 2023-05-10

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ibexa (affected versions not specified)

Description The issue concerns user settings, including preferred time zone and number of items per page, which could be accessed by anonymous users. This impacts only the anonymous users themselves and has no effect on logged-in users. The impact is limited, but it may be significant depending on the site's custom user settings. The fix restricts access to user settings, allowing only logged-in users to view their settings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

GHSA-R3FG-3R88-6X3F

Produtos afetados

Ibexa

Referências · 5

• https://github.com/ibexa/user · Nota
• https://github.com/ibexa/user/commit/77d1a0926d93ca85aa6faeea66bee55e0e067551 · Nota
• https://github.com/ibexa/user/security/advisories/GHSA-r3fg-3r88-6x3f · Nota
• https://osv.dev/vulnerability/GHSA-r3fg-3r88-6x3f · Aviso do Fabricante
• https://developers.ibexa.co/security-advisories/ibexa-sa-2023-002-user-settings-are-accessible-on-the-front-end-for-the-anonymous-user · Nota