PT-2023-15742 · Ibexa · Ez Publish Ibexa Kernel

Patrick Allaert · Published 2022-04-29 · Updated 2026-03-16 · CVE-2022-48367

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eZ Publish Ibexa Kernel versions prior to 7.5.28

Description An issue was discovered where access control based on object state is mishandled. This issue affects a policy used in roles to limit access to content based on specific object state values. Due to a flawed update, these limitations were ineffective, granting access to content regardless of the object state. The severity of this issue depends on the frontend design, as knowing the URL to the content may or may not be required to access it.

Recommendations For versions prior to 7.5.28, please apply the fix as soon as possible, especially if object state limitations are used in roles.

Fix

Missing Authorization

Improper Preservation of Permissions

Weakness Enumeration

CWE-862

CWE-281

Related Identifiers

CVE-2022-48367

GHSA-5X4F-7XGQ-R42X

GHSA-H5V2-WRHP-5V35

Affected Products

Ez Publish Ibexa Kernel

References · 11

• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-5x4f-7xgq-r42x · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5v2-wrhp-5v35 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5x4f-7xgq-r42x · Vendor Advisory
• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-004-ineffective-object-state-limitation-and-unauthenticated-fastly-purge · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48367 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48367 · Vendor Advisory
• https://github.com/ezsystems/ezpublish-kernel/commit/133c33cbcaa330953d6283865153f3dfdc7a2e45 · Note
• https://github.com/ezsystems/ezpublish-kernel · Note
• https://t.me/cvenotify/46072 · Telegram Post
• https://twitter.com/pulsepatchio/status/2033562682545332557 · Twitter Post
• https://t.me/cvenotify/113388 · Telegram Post