Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hhfp-81fr-zkhn
Vulnerability ID VCID-hhfp-81fr-zkhn
Aliases GHSA-xfqg-p48g-hh94
GMS-2022-1738
Summary Login timing attack in ezsystems/ezpublish-kernel Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-208 Observable Timing Discrepancy
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual CRITICAL https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-xfqg-p48g-hh94
generic_textual CRITICAL https://github.com/ezsystems/ezpublish-kernel
generic_textual CRITICAL https://github.com/ezsystems/ezpublish-kernel/commit/913fe17281536a91437d94e8267181ae8b57f5d5
cvssv3.1_qr CRITICAL https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-xfqg-p48g-hh94
generic_textual CRITICAL https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-xfqg-p48g-hh94
generic_textual CRITICAL https://issues.ibexa.co/browse/IBX-1755
Reference id Reference type URL
https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce
https://github.com/ezsystems/ezpublish-kernel
https://github.com/ezsystems/ezpublish-kernel/commit/913fe17281536a91437d94e8267181ae8b57f5d5
https://issues.ibexa.co/browse/IBX-1755
GHSA-xfqg-p48g-hh94 https://github.com/advisories/GHSA-xfqg-p48g-hh94
GHSA-xfqg-p48g-hh94 https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-xfqg-p48g-hh94
No exploits are available.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-04T17:53:20.542365+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-xfqg-p48g-hh94/GHSA-xfqg-p48g-hh94.json 38.6.0