CVE-2022-22120CWE-203

NocoDB - Observable Discrepancy in the password-reset feature

Medium · published January 10, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
71.6
In the wild
Unconfirmed
What it is

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01367 · 71.6th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2022-01-10T15:25Z
EPSS history
Timeline
  • 10 JAN 15:25Z
    NocoDB - Observable Discrepancy in the password-reset feature
    cvelistv5