CVE-2022-41876CWE-200CWE-922

ezplatform-graphql GraphQL queries can expose password hashes

High · published November 10, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
72.9
In the wild
Unconfirmed
What it is

ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01436 · 72.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-922 · Insecure Storage of Sensitive Information
Published
2022-11-10T00:00Z
EPSS history
Timeline
  • 10 NOV 00:00Z
    ezplatform-graphql GraphQL queries can expose password hashes
    cvelistv5