CVE-2022-3348 - Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet

Back Back to CVE browser

MEDIUM

Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet

Published Sep 28, 2022

4.9

MEDIUM

CVSS 3.1

EPSS 1.04%

Description

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.

Affected products

Vendor Tooljet Product Tooljet/tooljet Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <v1.26.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tooljet

Tooljet/tooljet

n/a

Version	Status	Constraints
unspecified	affected	<v1.26.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a81888810488b913863a46
x_refsource_MISCPatchThird Party Advisory
https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eac
x_refsource_CONFIRMExploitPatchThird Party Advisory

Link	Providers	Tags
https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a81888810488b913863a46		x_refsource_MISCPatchThird Party Advisory
https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eac		x_refsource_CONFIRMExploitPatchThird Party Advisory