Read the docs
TI-2022-23980 Aliases CVE-2022-48366GHSA-66m4-gc8h-hpjx

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19.

Priority LOW 18CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00458 39th percentileScored 2026-11-07
Fix Fixed ezsystems/ezplatform-kernel (Packagist): 1.3.19ezsystems/ezpublish-kernel (Packagist): 7.5.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ezsystems/ezplatform-kernel (Packagist)1.3.0 to before 1.3.191.3.19Patch availableGHSA-66m4-gc8h-hpjx
—ezsystems/ezpublish-kernel (Packagist)7.5.0 to before 7.5.297.5.29Patch availableGHSA-66m4-gc8h-hpjx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ezsystems/ezplatform-kernel (Packagist) Vendor— Affected 1.3.0 to before 1.3.19 Fixed in 1.3.19 Patch available GHSA-66m4-gc8h-hpjx
  • ezsystems/ezpublish-kernel (Packagist) Vendor— Affected 7.5.0 to before 7.5.29 Fixed in 7.5.29 Patch available GHSA-66m4-gc8h-hpjx

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:ibexa:commerce:*:*:*:*:*:*:*:*2.5.0 to before 2.5.13; 3.3.0 to before 3.3.18; 4.0.0 to before 4.0.7; 4.1.0 to before 4.1.4Vulnerableibexa
cpe:2.3:a:ibexa:digital_experience_platform:*:*:*:*:*:*:*:*3.3.0 to before 3.3.20; 4.0.0 to before 4.0.7; 4.1.0 to before 4.1.4Vulnerableibexa
cpe:2.3:a:ibexa:ez_platform:*:*:*:*:*:*:*:*before 2.5.30Vulnerableibexa
cpe:2.3:a:ibexa:ezplatform-page-builder:*:*:*:*:*:*:*:*1.3.0 to before 1.3.27; 2.3.0 to before 2.3.19Vulnerableibexa
cpe:2.3:a:ibexa:jmspaymentcorebundle:*:*:*:*:*:*:*:*3.0.0 to before 3.0.2Vulnerableibexa
cpe:2.3:o:ibexa:ez_platform_kernel:*:*:*:*:*:*:*:*1.3.0 to before 1.3.19; 7.5.0 to before 7.5.29Vulnerableibexa
cpe:2.3:o:ibexa:kernel:*:*:*:*:*:*:*:*4.0.0 to before 4.0.7; 4.1.0 to before 4.1.4Vulnerableibexa
  • cpe:2.3:a:ibexa:commerce:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.13; 3.3.0 to before 3.3.18; 4.0.0 to before 4.0.7; 4.1.0 to before 4.1.4 Vulnerable ·ibexa
  • cpe:2.3:a:ibexa:digital_experience_platform:*:*:*:*:*:*:*:* Versions 3.3.0 to before 3.3.20; 4.0.0 to before 4.0.7; 4.1.0 to before 4.1.4 Vulnerable ·ibexa
  • cpe:2.3:a:ibexa:ez_platform:*:*:*:*:*:*:*:* Versions before 2.5.30 Vulnerable ·ibexa
  • cpe:2.3:a:ibexa:ezplatform-page-builder:*:*:*:*:*:*:*:* Versions 1.3.0 to before 1.3.27; 2.3.0 to before 2.3.19 Vulnerable ·ibexa
  • cpe:2.3:a:ibexa:jmspaymentcorebundle:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.2 Vulnerable ·ibexa
  • cpe:2.3:o:ibexa:ez_platform_kernel:*:*:*:*:*:*:*:* Versions 1.3.0 to before 1.3.19; 7.5.0 to before 7.5.29 Vulnerable ·ibexa
  • cpe:2.3:o:ibexa:kernel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.0.7; 4.1.0 to before 4.1.4 Vulnerable ·ibexa

Remediation

  • Fix · GHSA-66m4-gc8h-hpjx ezsystems/ezplatform-kernel (Packagist) Fixed in 1.3.19 Advisory →
  • Fix · GHSA-66m4-gc8h-hpjx ezsystems/ezpublish-kernel (Packagist) Fixed in 7.5.29 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-48366
  2. 2026-10-03 Alias added: GHSA-66m4-gc8h-hpjx

References

Advisory 4

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences