Skip to content

IBX-1755: Login timing attack

Critical
glye published GHSA-342c-vcff-2ff2 May 31, 2022

Package

composer ezsystems/ezplatform-kernel (Composer)

Affected versions

v1.3.*

Patched versions

v1.3.19

Description

Please see https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce

Severity

Critical

CVE ID

No known CVE

Weaknesses

Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. Learn more on MITRE.