CVE-2022-31164 Tovy before v0.7.51 vulnerable to users logging in as and impersonating other users
Attackers can impersonate other users, including administrators, in the Tovy staff management system for Roblox groups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31164?
CVE-2022-31164 is a high-severity authentication bypass vulnerability in tovyblox tovy, published on 21 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. The problem has been patched in version 0.7.51.
Weakness: CWE-287
Which versions are affected by CVE-2022-31164?
It affects 1 product.
Products include Tovyblox Tovy.
How do I fix CVE-2022-31164?
No fix has been published for CVE-2022-31164 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-31164 being exploited?
There is no known exploitation of CVE-2022-31164 in the wild and no public exploit code.