CVE-2022-48366
Timing attack in eZ Platform Ibexa
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
- Record
CVE-2022-48366- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
- Record
CVE-2022-48366- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2023-0895
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
- Record
EUVD-2023-0895- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-66m4-gc8h-hpjx
Timing attack in eZ Platform Ibexa
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
- Record
GHSA-66m4-gc8h-hpjx- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
- Record
CVE-2022-48366- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-66m4-gc8h-hpjx
Timing attack in eZ Platform Ibexa
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
- Record
GHSA-66m4-gc8h-hpjx- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezplatform-kernelPackagist |
1.3.0 up to 1.3.19 | 1.3.19 |
ezsystems/ezpublish-kernelPackagist |
7.5.0 up to 7.5.29 | 7.5.29 |
ezsystems/ezplatform-kernelPackagist |
1.3.0 up to 1.3.19, plus listed versions v1.3.0v1.3.1v1.3.1.1v1.3.10v1.3.11 Show 15 moreShow lessv1.3.12v1.3.13v1.3.14v1.3.15v1.3.16v1.3.17v1.3.18v1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9 |
1.3.19 |
ezsystems/ezpublish-kernelPackagist |
7.5.0 up to 7.5.29, plus listed versions v7.5.0v7.5.1v7.5.10v7.5.11v7.5.12 Show 31 moreShow lessv7.5.13v7.5.14v7.5.15v7.5.15.1v7.5.15.2v7.5.16v7.5.17v7.5.18v7.5.19v7.5.2v7.5.20v7.5.21v7.5.22v7.5.23v7.5.24v7.5.25v7.5.26v7.5.27v7.5.28v7.5.3v7.5.4v7.5.5v7.5.6v7.5.6-rc1v7.5.6.2v7.5.7v7.5.7-rc1v7.5.7.1v7.5.8v7.5.9v7.5.9.1 |
7.5.29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-48366 is a low vulnerability (CVSS 3.7) in Ibexa Ez Platform, published March 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in ezsystems/ezplatform-kernel 1.3.19.
References
developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce
github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-xfqg-p48g-hh94
nvd.nist.gov/vuln/detail/CVE-2022-48366