CVE-2022-27978 Business logic in n/a

What is CVE-2022-27978?

CVE-2022-27978 is a high-severity vulnerability in n/a, published on 26 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.

Weakness: CWE-755

Which versions are affected by CVE-2022-27978?

It affects 1 product.

Products include Tooljet Tooljet.

How do I fix CVE-2022-27978?

No fix has been published for CVE-2022-27978 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-27978 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-27978 exists.

Other vulnerabilities in n/a

• CVE-2022-3422 Improper Privilege Management in tooljet/tooljet Critical 9.8
• CVE-2022-2631 Improper Access Control in tooljet/tooljet Critical 9.8
• CVE-2022-2037 Excessive Attack Surface in tooljet/tooljet Critical 9.8
• CVE-2022-23067 ToolJet - Token Leakage via Referer Header High 8.8
• CVE-2022-3019 Improper Access Control in tooljet/tooljet High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wxm6-gcq6-r4p5.