What’s Vulnerable › Vulnerabilities

CVE-2022-48365

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-12 · updated 2026-06-17
• Weakness: CWE-269

Description

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.

Affected products

• ibexa Digital Experience Platform: from 3.3.0 before 3.3.28; from 4.2.0 before 4.2.3 — fixed in 3.3.28, 4.2.3
• ibexa Ez Platform: from 2.5.0 before 2.5.31 — fixed in 2.5.31
• ibexa Ez Platform Kernel: from 1.3.0 before 1.3.26; from 7.5.0 before 7.5.30 — fixed in 1.3.26, 7.5.30

How to fix

Upgrade to a fixed version: ibexa Digital Experience Platform 3.3.28, 4.2.3; ibexa Ez Platform 2.5.31; ibexa Ez Platform Kernel 1.3.26, 7.5.30. Check the vendor advisory for mitigations.

References

• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips
• https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp
• https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779ab
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7g
• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips
• https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp
• https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779ab
• https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7g

Get alerted when CVE-2022-48365 or the next vulnerability affects your stack