PT-2022-17219 · Ibexa+1 · Ibexa Dxp+1

Christoph Rottermanner + 1 · Published 2022-02-18 · Updated 2023-08-08 · CVE-2022-25336

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25 Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11

Description The issue allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced. When image files are uploaded, they are made accessible under a name similar to the original file name. This poses two issues: certain injection attacks can be possible due to not all possible attack vectors being removed from the original file name, and direct access to the images is not access controlled, allowing images not meant to be publicly accessible to be accessed if the image path and filename is correctly deduced or guessed.

Recommendations For Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25, update to version 7.5.26 or later. For Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11, update to version 1.3.12 or later. As a temporary workaround, consider restricting access to image files to minimize the risk of exploitation.

Fix

IDOR

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-639

CWE-668

Related Identifiers

CVE-2022-25336

GHSA-X8XX-X82Q-42Q3

Affected Products

Ibexa Dxp

Ezpublish-Kernel

References · 7

• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25336 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x8xx-x82q-42q3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25336 · Security Note
• https://github.com/ezsystems/ezplatform-kernel · Note
• https://t.me/cibsecurity/37721 · Telegram Post
• https://t.me/cvenotify/27701 · Telegram Post