3.7

CVE-2022-48366

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibexa ≫ Commerce Version >= 2.5.0 < 2.5.13
Ibexa ≫ Commerce Version >= 3.3.0 < 3.3.18
Ibexa ≫ Commerce Version >= 4.0.0 < 4.0.7
Ibexa ≫ Commerce Version >= 4.1.0 < 4.1.4
Ibexa ≫ Digital Experience Platform Version >= 3.3.0 < 3.3.20
Ibexa ≫ Digital Experience Platform Version >= 4.0.0 < 4.0.7
Ibexa ≫ Digital Experience Platform Version >= 4.1.0 < 4.1.4
Ibexa ≫ Ez Platform Version < 2.5.30
Ibexa ≫ Ezplatform-page-builder Version >= 1.3.0 < 1.3.27
Ibexa ≫ Ezplatform-page-builder Version >= 2.3.0 < 2.3.19
Ibexa ≫ Jmspaymentcorebundle Version >= 3.0.0 < 3.0.2
Ibexa ≫ Ez Platform Kernel Version >= 1.3.0 < 1.3.19
Ibexa ≫ Ez Platform Kernel Version >= 7.5.0 < 7.5.29
Ibexa ≫ Kernel Version >= 4.0.0 < 4.0.7
Ibexa ≫ Kernel Version >= 4.1.0 < 4.1.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.445
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.