PT-2022-28244 · Unknown · Company Account Feature

Published 2022-11-10 · Updated 2022-11-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Company account feature version 4 and later

Description A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically given to administrators. The issue can be exploited by users with this policy, so it is recommended to verify who has this policy in the installation.

Recommendations For version 4 and later, apply the fix to ensure subtree limitations work as intended. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-G6JC-XRC3-4WWQ

Affected Products

Company Account Feature

References · 5

• https://osv.dev/vulnerability/GHSA-g6jc-xrc3-4wwq · Vendor Advisory
• https://github.com/ibexa/admin-ui · Note
• https://github.com/ibexa/admin-ui/commit/e34abb0cf4e463ef86a8bda907496a8dd9967807 · Note
• https://github.com/ibexa/admin-ui/security/advisories/GHSA-g6jc-xrc3-4wwq · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips · Note