Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-48365: eZ Platform Ibexa Kernel: Company admin role gives excessive privileges

CVE-2022-48365 · published 3 years ago

Summary

The administrative role for a company in eZ Platform Ibexa Kernel has too many permissions, potentially allowing unauthorized access to sensitive areas of the website. This affects the security of your site's content and data, so ensure you update to the latest version of the software to fix this issue.

What to do

Update ezsystems ezpublish-kernel to version 7.5.30.
Update ezsystems ezplatform-kernel to version 1.3.26.
Update ibexa ez_platform to version 2.5.31 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	ezsystems	ezpublish-kernel	>= 7.5.0, < 7.5.30 Fix: upgrade to 7.5.30
composer	ezsystems	ezplatform-kernel	>= 1.3.0, < 1.3.26 Fix: upgrade to 1.3.26
–	ibexa	digital_experience_platform	>= 3.3.0, < 3.3.28 >= 4.2.0, < 4.2.3 `cpe:2.3:a:ibexa:digital_experience_platform::::::::`
–	ibexa	ez_platform	>= 2.5.0, < 2.5.31 `cpe:2.3:a:ibexa:ez_platform::::::::`
–	ibexa	ez_platform_kernel	>= 1.3.0, < 1.3.26 >= 7.5.0, < 7.5.30 `cpe:2.3:o:ibexa:ez_platform_kernel::::::::`

Original advisory text

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.

References

https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulne... Vendor Advisory
https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh... Vendor Advisory
https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq... Vendor Advisory
https://github.com/advisories/GHSA-qq2j-9pf8-g58c
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48365... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-48365 Vendor Advisory
https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f976394... Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

Timeline

Published12 Mar 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-qq2j-9pf8-g58c · GHSA

CVE-2022-48365 · NVD

CVE-2022-48365 · OSV

Track software like this

Free during beta