CVE-2022-3348

Katalog CVE

CVSS 4.9 · Medium EPSS 1,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada tooljet. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.

Rincian

Terbit di NVD

28 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a81888810488b913863a46 patch · advisory pihak ketiga
• https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eac exploit · patch · advisory pihak ketiga