CVE-2022-23067

Katalog CVE

CVSS 8.8 · High EPSS 1,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada tooljet. Skor CVSS 3.1 8.8 (High) menurut mend.io.

Deskripsi (NVD)

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

Rincian

Terbit di NVD

18 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber mend.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101 patch · advisory pihak ketiga
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067 exploit · advisory pihak ketiga