CVE-2022-41876 json
ezplatform-graphql GraphQL queries can expose password hashes
published 2022-11-10 3 y ago modified 2026-06-17 4 mo ago also GHSA-c7pc-pgf6-mfh5 , EUVD-2022-7309
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.
Patch / fix
- packagist ezsystems/ezplatform-graphql 1.0.13, 2.3.12
- ibexa ezplatform-graphql 1.0.13, 2.3.12
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.64% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | ezsystems/ezplatform-graphql | >=1.0.0-rc1, <1.0.13 >=2.0.0-beta1, <2.3.12 |
1.0.13 2.3.12 |
Affected products
- ezsystems ezplatform-graphql
Classification
References
-
github.com
/ezsystems/ezplatform-graphql/security/advisories/GHSA-c7pc-pgf6-mfh5
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-41876
advisory
-
developers.ibexa.co
/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-draf
web
-
github.com
/ezsystems/ezplatform-graphql
package
Sources
- CVE List CVE-2022-41876
- GitHub Advisory GHSA-c7pc-pgf6-mfh5
- NVD CVE-2022-41876
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.