PT-2023-33056 · Ibexa · Ibexa

Published 2023-05-10 · Updated 2023-05-10

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ibexa (affected versions not specified)

Description The issue concerns user settings, including preferred time zone and number of items per page, which could be accessed by anonymous users. This impacts only the anonymous users themselves and has no effect on logged-in users. The impact is limited, but it may be significant depending on the site's custom user settings. The fix restricts access to user settings, allowing only logged-in users to view their settings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-R3FG-3R88-6X3F

Affected Products

Ibexa

References · 5

• https://osv.dev/vulnerability/GHSA-r3fg-3r88-6x3f · Vendor Advisory
• https://github.com/ibexa/user · Note
• https://github.com/ibexa/user/commit/77d1a0926d93ca85aa6faeea66bee55e0e067551 · Note
• https://github.com/ibexa/user/security/advisories/GHSA-r3fg-3r88-6x3f · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2023-002-user-settings-are-accessible-on-the-front-end-for-the-anonymous-user · Note