// For flags

CVE-2022-41876

ezplatform-graphql GraphQL queries can expose password hashes

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.

ezplatform-graphql es una implementación de servidor GraphQL para Ibexa DXP e Ibexa Open Source. Las versiones anteriores a 2.3.12 y 1.0.13 están sujetas a almacenamiento inseguro de información confidencial. Las consultas GraphQL no autenticadas para cuentas de usuario pueden exponer hashes de contraseñas de usuarios que han creado o modificado contenido, normalmente administradores y editores. Este problema se solucionó en las versiones 2.3.12 y 1.0.13 en la rama 1.X. Los usuarios que no puedan actualizar pueden eliminar la entrada "passwordHash" de "src/bundle/Resources/config/graphql/User.types.yaml" en el paquete GraphQL y otras propiedades como tipo de hash, correo electrónico e inicio de sesión, si lo prefieren.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-30 CVE Reserved
  • 2022-11-10 CVE Published
  • 2023-03-24 First Exploit
  • 2024-06-02 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-922: Insecure Storage of Sensitive Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ibexa
Search vendor "Ibexa"
 Ezplatform-graphql
Search vendor "Ibexa" for product "Ezplatform-graphql"
 >= 1.0.0 < 1.0.13
Search vendor "Ibexa" for product "Ezplatform-graphql" and version " >= 1.0.0 < 1.0.13"
-
Affected
Ibexa
Search vendor "Ibexa"
 Ezplatform-graphql
Search vendor "Ibexa" for product "Ezplatform-graphql"
 >= 2.0.0 < 2.3.12
Search vendor "Ibexa" for product "Ezplatform-graphql" and version " >= 2.0.0 < 2.3.12"
-
Affected
Ibexa
Search vendor "Ibexa"
 Ezplatform-graphql
Search vendor "Ibexa" for product "Ezplatform-graphql"
 2.0.0
Search vendor "Ibexa" for product "Ezplatform-graphql" and version "2.0.0"
beta1
Affected