File Validation Bypass

ibexa/core is vulnerable to File Validation Bypass. The vulnerability is due to inadequate file type validation within the validate function in FileExtensionBlackListValidator.php. When attempting to publish content with rejected file types, the validation fails which does prevent publication, bu...

PT-2024-40225

Name of the Vulnerable Software and Affected Versions: ibexa core affected versions not specified Description: The issue allows unwanted file types to be stored even if they are not easily accessible due to the content not being published. This occurs when file validation is configured to reject...

Privilege Escalation

ibexa/core is vulnerable to privilege escalation. The vulnerability exists because the library does not properly handle the company admin role, allowing an admin user to assign any role to a user...

Timing Attack

ibexa/core is vulnerable to timing attacks. The vulnerability exists because the library uses random execution time, which is not a secure enough algorithm to be used when authenticating users into the system, resulting in sensitive user information disclosure...

Privilege Escalation

ibexa/core is vulnerable to privilege escalation. An attacker can limit the access to content based on specific object state values by using an object state limitation policy through the evaluate function of ObjectStateLimitationType.php...