Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2022-48367

CVE-2022-48367:
Access control issue in ezsystems/ezpublish-kernel

9.8

CVSS Score

Basic Information

CVE ID
CVE-2022-48367
GHSA ID
GHSA-h5v2-wrhp-5v35
EPSS Score
-
CWE
CWE-862
Published
3/12/2023
Updated
8/17/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
ezsystems/ezpublish-kernelcomposer>= 7.5.0, < 7.5.287.5.28

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly states that object state-based access control limitations were ineffective due to a flawed update. The ObjectStateLimitationType::evaluate method is the core component responsible for evaluating whether a user meets the object state requirements. A failure in this method to properly check the object state would directly explain why access was granted regardless of state. This matches the CWE-862 (Missing Authorization) classification, as the authorization check was not properly implemented in the affected versions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

****ss *ontrol **s** on o*j**t st*t* is mis**n*l**. T*is is * poli*y you **n us* in your rol*s to limit ****ss to *ont*nt **s** on sp**i*i* o*j**t st*t* v*lu*s. *u* to * *l*w** **rli*r up**t*, t**s* limit*tions w*r* in*****tiv* in r*l**s*s m*** sin**

Reasoning

T** vuln*r**ility **s*ription *xpli*itly st*t*s t**t o*j**t st*t*-**s** ****ss *ontrol limit*tions w*r* in*****tiv* *u* to * *l*w** up**t*. T** O*j**tSt*t*Limit*tionTyp*::*v*lu*t* m*t*o* is t** *or* *ompon*nt r*sponsi*l* *or *v*lu*tin* w**t**r * us*r