8.8

CVE-2022-3019

Exploit

Improper Access Control in tooljet/tooljet

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tooljet ≫ Tooljet Version < 1.23.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.474
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
security@huntr.dev 7.1 1.2 5.9
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://github.com/tooljet/tooljet/commit/45e0d3302d92df7d7f2d609c31cea71165600b79
Patch
Third Party Advisory
https://huntr.dev/bounties/a610300b-ce3c-4995-8337-11942b3621bf
Patch
Third Party Advisory
Exploit