CVE-2022-48366: Ibexa Commerce

Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.

Affected products

• Ibexa Commerce: from 2.5.0, before 2.5.13 (fixed in 2.5.13); from 3.3.0, before 3.3.18 (fixed in 3.3.18); from 4.0.0, before 4.0.7 (fixed in 4.0.7); from 4.1.0, before 4.1.4 (fixed in 4.1.4)
• Ibexa Digital Experience Platform: from 3.3.0, before 3.3.20 (fixed in 3.3.20); from 4.0.0, before 4.0.7 (fixed in 4.0.7); from 4.1.0, before 4.1.4 (fixed in 4.1.4)
• Ibexa Ez Platform: before 2.5.30 (fixed in 2.5.30)
• Ibexa Ez Platform Kernel: from 1.3.0, before 1.3.19 (fixed in 1.3.19); from 7.5.0, before 7.5.29 (fixed in 7.5.29)
• Ibexa Ezplatform-Page-Builder: from 1.3.0, before 1.3.27 (fixed in 1.3.27); from 2.3.0, before 2.3.19 (fixed in 2.3.19)
• Ibexa Jmspaymentcorebundle: from 3.0.0, before 3.0.2 (fixed in 3.0.2)
• Ibexa Kernel: from 4.0.0, before 4.0.7 (fixed in 4.0.7); from 4.1.0, before 4.1.4 (fixed in 4.1.4)

Published 2023-03-12. Last modified 2026-06-17.