Back to Database
Status published
Medium
CVE-2022-25336
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12...
Vulnerability Description
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25336
Credits & Attribution
No credits recorded in the NVD database.
References
More from ibexa
View All →CVE-2025-67719
Ibexa User Bundle is missing password change validation
High
8.5
CVE-2024-53864
Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui
Medium
5.3
CVE-2024-43369
Persistent Cross-site Scripting in Ibexa RichText Field Type
High
7.2
CVE-2024-39318
Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
Medium
5.4
CVE-2022-48367
An issue was discovered in eZ Publish Ibexa Kernel before...
Unknown
0
Affected Vendor
ibexa
View all reports →Affected Software
ez platform kernel
Vulnerable Versions:
1.3.0, 7.5.0
Timeline
Official Publish:
February 18th, 2022
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.