CVE-2022-32170

Katalog CVE

CVSS 4.3 · Medium EPSS 0,65%

Kerentanan Improper Authorization pada bytebase. Skor CVSS 3.1 4.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.

Rincian

Terbit di NVD

28 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mend.io/vulnerability-database/CVE-2022-32170 exploit · advisory pihak ketiga
• https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197