Code injection

2023-03-1205:15:00

PRIOn knowledge base

www.prio-n.com

ez platform

ibexa kernel

code injection

timing attack

account existence

4.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.5%

JSON

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.

CPENameOperatorVersion
commercege4.1.0
commercelt4.1.4
commercege4.0.0
commercelt4.0.7
commercege3.3.0
commercelt3.3.18
commercege2.5.0
commercelt2.5.13
digital_experience_platformge4.1.0
digital_experience_platformlt4.1.4

Name	Operator	Version
commerce	ge	4.1.0
commerce	lt	4.1.4
commerce	ge	4.0.0
commerce	lt	4.0.7
commerce	ge	3.3.0
commerce	lt	3.3.18
commerce	ge	2.5.0
commerce	lt	2.5.13
digital_experience_platform	ge	4.1.0
digital_experience_platform	lt	4.1.4