CVE-2022-34771

Tabit - arbitrary SMS send on Tabits behalf

Medium · published August 22, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the system. In addition, the API probably has some kind of template injection potential. When entering {{OTP}} in the custom message field it is formatted into an OTP.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00437 · 36.9th percentile
Published
2022-08-22T14:40Z
EPSS history
Timeline
  • 22 AUG 14:40Z
    Tabit - arbitrary SMS send on Tabits behalf
    cvelistv5