Is CVE-2022-41876 actively exploited?

No active exploitation of CVE-2022-41876 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-41876 be exploited remotely?

Yes. CVE-2022-41876 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-41876?

CVE-2022-41876 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2022-41876

MEDIUM

CVE-2022-41876

CWE-200Published: November 10, 2022· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.

NVD Source

Technical Analysis

CVE-2022-41876 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.