Vulnerability · Published Aug 22, 2022 · Assigned by INCD

CVE-2022-34775Tabit - Excessive data exposure

Medium 6.3

In plain English

A medium-severity security flaw in Tabit from Tabit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 59.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack.

Affected products (as reported)

Vendor	Product	Versions
Tabit	Tabit	3.27.0 – before 3.27.0*

References

https://www.gov.il/en/departments/faq/cve_advisories x_refsource_MISC