Loading...
Skip to main content
GeekWala

CVE-2022-48367 — Access control issue in...

CRITICAL

Access control issue in ezsystems/ezpublish-kernel

Published March 12, 2023Updated September 10, 2026Source: osv

Summary

Access control based on object state is mishandled. This is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.

Advisory Timeline

  • First published March 12, 2023 (1310 days ago).
  • Last revised September 10, 2026 — 1278 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update ezsystems/ezpublish-kernel to 7.5.28 or later
composer require "ezsystems/ezpublish-kernel:^7.5.28"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
ezsystems/ezpublish-kernel
packagist
v7.5.0, v7.5.1, v7.5.10, v7.5.11 (+31 more)7.5.28

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-862
    Missing AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-48367?
Access control issue in ezsystems/ezpublish-kernel This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-48367?
CVE-2022-48367 affects ezsystems/ezpublish-kernel. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-48367 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-h5v2-wrhp-5v35
GHSA-5x4f-7xgq-r42x

Related CVEs

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies