Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-zc3k-pcqc-wuem
Vulnerability ID VCID-zc3k-pcqc-wuem
Aliases GHSA-342c-vcff-2ff2
GMS-2022-1734
Summary Login timing attack in ezsystems/ezplatform-kernel Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-208 Observable Timing Discrepancy
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual CRITICAL https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-342c-vcff-2ff2
generic_textual CRITICAL https://github.com/ezsystems/ezplatform-kernel
cvssv3.1_qr CRITICAL https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-342c-vcff-2ff2
generic_textual CRITICAL https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-342c-vcff-2ff2
Reference id Reference type URL
https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce
https://github.com/ezsystems/ezplatform-kernel
GHSA-342c-vcff-2ff2 https://github.com/advisories/GHSA-342c-vcff-2ff2
GHSA-342c-vcff-2ff2 https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-342c-vcff-2ff2
No exploits are available.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-04T17:53:23.899652+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-342c-vcff-2ff2/GHSA-342c-vcff-2ff2.json 38.6.0