CVE-2022-3019: Improper Access Control in tooljet/tooljet
Published Aug 29, 2022
·Updated
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
Affected Software
1 affected component
Tooljet tooljet<1.23.0
Remediation
Event History
Aug 29, 2022
CVE Published
via MITRE·05:30 AM
Data Sourced
via MITRE·05:30 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-3019.
2
What is the severity of CVE-2022-3019?
CVE-2022-3019 has a severity rating of 8.8 (high).
3
What software is affected by CVE-2022-3019?
CVE-2022-3019 affects Tooljet Tooljet versions up to 1.23.0.
4
How can the vulnerability be exploited?
The vulnerability can be exploited by using the forgot password token to take over the account of a user who has commented in the app.
5
Is brute-forcing comment IDs a possible exploitation method for this vulnerability?
While brute-forcing comment IDs might be an option, it is not reliable as it would take a long time to find a valid one.