Vulnerability · Published Jan 10, 2022 · Assigned by Mend
CVE-2022-22120NocoDB - Observable Discrepancy in the password-reset feature
Medium 5.3
In plain English
A medium-severity security flaw in nocodb from nocodb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.
Affected products (as reported)
Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/nocodb/nocodb/commit/f46e89b0 x_refsource_MISC
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120 x_refsource_MISC