Vulnerability · Published Jul 21, 2022 · Assigned by GitHub_M
CVE-2022-31164Tovy before v0.7.51 vulnerable to users logging in as and impersonating other users
High 7.5
In plain English
A high-severity improper authentication in tovy from tovyblox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 48.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. The problem has been patched in version 0.7.51.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/tovyblox/tovy/security/advisories/GHSA-j6f8-wh4v-jc37 x_refsource_CONFIRM
- https://github.com/tovyblox/tovy/pull/63 x_refsource_MISC