CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
52.6%
Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Vendor | Product | Version | CPE |
---|---|---|---|
ezsystems | ezplatform-kernel | * | cpe:2.3:a:ezsystems:ezplatform-kernel:*:*:*:*:*:*:*:* |
ezsystems | ezpublish-kernel | * | cpe:2.3:a:ezsystems:ezpublish-kernel:*:*:*:*:*:*:*:* |
developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips
github.com/advisories/GHSA-qq2j-9pf8-g58c
github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp
github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779ab
github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7g
nvd.nist.gov/vuln/detail/CVE-2022-48365