GHSA-r3fg-3r88-6x3f json
Ibexa User Settings are accessible on the front-end for anonymous user
published 3y ago modified last yr.
- cvss
- 5.4
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
### Impact This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and had no impact on logged in users. As such the impact is limited, even if custom user settings have been added, but please consider if this matters for your site. The fix ensures that only logged in users can access their user settings.
### References https://developers.ibexa.co/security-advisories/ibexa-sa-2023-002-user-settings-are-accessible-on-the-front-end-for-the-anonymous-user
Patch / fix
Is GHSA-r3fg-3r88-6x3f in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | ibexa/user | >=4.0.0, <4.4.3 |
4.4.3 |
References
-
github.com
/ibexa/user/commit/77d1a0926d93ca85aa6faeea66bee55e0e067551
web
-
github.com
/ibexa/user/security/advisories/GHSA-r3fg-3r88-6x3f
web
-
developers.ibexa.co
/security-advisories/ibexa-sa-2023-002-user-settings-are-accessible-on-the-front-end-for-the-anonymous-user
web
-
github.com
/ibexa/user
package
Sources
- GitHub Advisory GHSA-r3fg-3r88-6x3f
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.