Connect with us
X
Categories:

Technology

GraphQL password hash leak problem fixed in Ibexa DXP

Published

on

GraphQL password hash leak problem fixed in Ibexa DXP
Share this post:

Norwegian software firm Ibexa is urging users to apply a new patch immediately to resolve a sensitive data leak vulnerability impacting its Digital Experience Platform (DXP).

DXP is a business-to-business application comprising e-commerce, data management, cloud hosting, and content management system (CMS) functionality.

The flaw resides in Ibexa’s GraphQL Bundle, the GraphQL server implementation for Ibexa DXP and Ibexa Open Source. GraphQL is an open source data query language for APIs.

“It was unfortunately a critical issue. Both because it could reveal password hashes (not passwords), hash types, email addresses, and login names of some users (typically editors and admins) but also because those users then had to change their passwords, in case there had been a leak,” Gunnstein Lye, who works on product security for Ibexa, told Daily Swig.

However, the ‘critical’ bug, tracked as CVE-2022-41876, was ultimately assigned a ‘high’ CVSS severity score of 7.5 by GitHub and then ‘medium’ by NIST (CVSS 5.3).

On November 11, Ibexa published a security advisory concerning the issue and a trio of other, less severe vulnerabilities.

Endpoint in error

The hash leak vulnerability arose from how the ezplatform-graphql endpoint insecurely stored sensitive information, allowing attackers to send unauthenticated GraphQL queries for user accounts.

“In many cases, only administrators and editors are affected, as end users often do not have the required permissions,” the advisory noted. However, if a vulnerable installation also allows user-generated content, then this could expand the security issue beyond the scope of administrator and editor accounts.

The vulnerabilities are resolved in Ibexa DXP v3.3.28, v4.2.3, and eZ Platform v2.5.31.

Ibexa developers also recommend that all user passwords are reset, and that once the update has been applied, users regenerate the GraphQL schema. While the GraphQL endpoint is enabled by default, users can choose to disable this feature or enforce logins and authentication if they choose.

‘Prescient’

Lye commented: “It’s extra unfortunate when a vulnerability can’t simply be fixed by applying an update, but requires further action like this, since it slows down the resolution for our users.

“For quite some time before this we had advised users to not keep GraphQL open on the frontend if they didn’t actually use it there. Not that we suspected any vulnerability in it, but because it’s generally wise to reduce the attack surface when you can easily do so. This turned out to be almost prescient in this case.”

Ibexa thanked Lexfo security engineer Philippe Tranca for reporting the issue.

The other resolved security flaws – a subtree limitation failure in role assignment policies, a cross-site scripting (XSS) flaw in content type entries ‘name’ and ‘short name’, and an HTML tag injection issue – require backend access with high-level privileges to exploit, said Lye.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
Roisea: Most Advanced Crypto Trading Platform for Bitcoin
Business5 days ago

The Role of Regulation in Crypto Investment: Navigating Legal Frameworks

Volatility in Commodities and How to Deal with It
Business3 weeks ago

Volatility in Commodities and How to Deal with It

Expanding Living Space
Lifestyle2 months ago

Expanding Living Space: Prefabricated Workshop Building Kits for Extra Rooms

BeBe Winans
Lyrics3 months ago

BeBe Winans – It All Comes Down to Love [Lyrics]

BeBe Winans
Music3 months ago

[Music] BeBe Winans – It All Comes Down to Love

The Countdown Begins to the Tournament That Has It All
ANE Football Analytical3 months ago

AFCON 2023: A Sporting Spectacle Set to Captivate the World

Litecoin: What Makes It The Crypto Winner?
Technology4 months ago

Runny Inflation Can Drive Cryptocurrency Adoption

Black and White French Bulldog puppies Frenchie Joy
Lifestyle5 months ago

Black and White French Bulldog puppies Frenchie Joy

3 Serious Reasons to Keep Your Teenager Away From Social Media
Lifestyle5 months ago

3 Serious Reasons to Keep Your Teenager Away From Social Media

Boxing vs MMA What Makes Them So Different
Sports5 months ago

Boxing vs MMA: What Makes Them So Different

Roisea: Most Advanced Crypto Trading Platform for Bitcoin
Technology5 months ago

NFTs and Intellectual Property Rights: Shaping Creative Ownership

The Birth of a Rugby Nation South Africas Love Affair with the Sport
Sports10 months ago

The Birth of a Rugby Nation: South Africa’s Love Affair with the Sport

A Beginner's Guide to Radicle (RAD): The Future of Peer-to-Peer Development
Technology10 months ago

A Beginner’s Guide to Radicle (RAD): The Future of Peer-to-Peer Development

Analysis of Nigeria's Renewable Energy Sector: Opportunities and Challenges
Technology11 months ago

Analysis of Nigeria’s Renewable Energy Sector: Opportunities and Challenges

Casino Gaming Poker
Sports12 months ago

What Are The Various Types Of Online Slots?

Luka Modric celebrates after scoring Real Madrid's second goal against Celta Vigo.
Sports1 year ago

Luka Modric set to join Ronaldo in Saudi Arabia’s Al Nassr

WHO World Health Organization
Health1 year ago

WHO debunks claims that tuberculosis is caused by witchcraft, poison

Atiku Abubakar
News1 year ago

2023 Election: Why DSS must arrest Fani-Kayode – Atiku

PDP Logo Umbrella
News1 year ago

PDP suspends National Chairman

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Final Episode 13)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 12)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 11)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 10)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 09)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 08)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 07)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 06)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 05)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 04)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 03)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 02)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Episode 01)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 year ago

[STORY] THE PASTOR’S DAUGHTER (Complete Episodes)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 year ago

[STORY] PAPA LOVES HIS GIRLS (Episode 16)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 year ago

[STORY] PAPA LOVES HIS GIRLS (Episode 15)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 year ago

[STORY] PAPA LOVES HIS GIRLS (Episode 14)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 year ago

[STORY] PAPA LOVES HIS GIRLS (Episode 13)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 year ago

[STORY] PAPA LOVES HIS GIRLS (Episode 12)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 year ago

[STORY] PAPA LOVES HIS GIRLS (Episode 11)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 year ago

[STORY] PAPA LOVES HIS GIRLS (Episode 10)

ANE Billboard Hots