CVE-2022-48366

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-12 · updated 2026-06-17
Weakness: CWE-362

Description

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.

Affected products

ibexa Commerce: from 2.5.0 before 2.5.13; from 3.3.0 before 3.3.18; from 4.0.0 before 4.0.7; from 4.1.0 before 4.1.4 — fixed in 2.5.13, 3.3.18, 4.0.7, 4.1.4
ibexa Digital Experience Platform: from 3.3.0 before 3.3.20; from 4.0.0 before 4.0.7; from 4.1.0 before 4.1.4 — fixed in 3.3.20, 4.0.7, 4.1.4
ibexa Ez Platform: before 2.5.30 — fixed in 2.5.30
ibexa Ez Platform Kernel: from 1.3.0 before 1.3.19; from 7.5.0 before 7.5.29 — fixed in 1.3.19, 7.5.29
ibexa Ezplatform-Page-Builder: from 1.3.0 before 1.3.27; from 2.3.0 before 2.3.19 — fixed in 1.3.27, 2.3.19
ibexa Jmspaymentcorebundle: from 3.0.0 before 3.0.2 — fixed in 3.0.2
ibexa Kernel: from 4.0.0 before 4.0.7; from 4.1.0 before 4.1.4 — fixed in 4.0.7, 4.1.4

How to fix

Upgrade to a fixed version: ibexa Commerce 2.5.13, 3.3.18, 4.0.7, 4.1.4; ibexa Digital Experience Platform 3.3.20, 4.0.7, 4.1.4; ibexa Ez Platform 2.5.30; ibexa Ez Platform Kernel 1.3.19, 7.5.29; ibexa Ezplatform-Page-Builder 1.3.27, 2.3.19; ibexa Jmspaymentcorebundle 3.0.2; ibexa Kernel 4.0.7, 4.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-48366 or the next vulnerability affects your stack