CVE-2022-3019CWE-284

Improper Access Control in tooljet/tooljet

High · published August 29, 2022

CVSS v3.0
7.1
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00934 · 60.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2022-08-29T05:30Z
EPSS history
Timeline
  • 29 AUG 05:30Z
    Improper Access Control in tooljet/tooljet
    cvelistv5