Skip to content
OpenAdvisories
Low · 3.7 CVE-2022-48366 EUVD-2023-0895GHSA-66m4-gc8h-hpjx

Timing attack in eZ Platform Ibexa

Published Mar 12, 2023 · Updated Mar 4, 2025 · Assigned by mitre

Package: ezsystems/ezplatform-kernel Package: ezsystems/ezpublish-kernel Ecosystem: Packagist

Description

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist ezsystems/ezplatform-kernel >= 1.3.0, < 1.3.19 1.3.19 GHSA-66m4-gc8h-hpjx
Packagist ezsystems/ezpublish-kernel >= 7.5.0, < 7.5.29 7.5.29 GHSA-66m4-gc8h-hpjx

References