CVE-2022-22120 NocoDB - Observable Discrepancy in the password-reset feature
Attackers can enumerate registered user email addresses by observing error messages during password reset requests in NocoDB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22120?
CVE-2022-22120 is a medium-severity vulnerability in nocodb, published on 10 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.
Weakness: CWE-203
Which versions are affected by CVE-2022-22120?
It affects 1 product.
Products include Nocodb Nocodb.
How do I fix CVE-2022-22120?
No fix has been published for CVE-2022-22120 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-22120 being exploited?
There is no known exploitation of CVE-2022-22120 in the wild and no public exploit code.
Other vulnerabilities in nocodb
- CVE-2022-2339 Server-Side Request Forgery (SSRF) in nocodb/nocodb
- CVE-2022-2062 Generation of Error Message Containing Sensitive Information in nocodb/nocodb
- CVE-2022-2064 Insufficient Session Expiration in nocodb/nocodb
- CVE-2022-2063 Improper Privilege Management in nocodb/nocodb
- CVE-2022-2022 Cross-site Scripting (XSS) - Stored in nocodb/nocodb
Sources
Also known as GHSA-w7rr-mwmp-rjxv.