CVE-2022-22120

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.37% chance of exploitation in the next 30 days, 70th percentile

Published

2022-01-10

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120

References

• CVE Record
• NVD entry

Related

• CVE-2022-2212
• CVE-2022-22121
• CVE-2022-22117
• CVE-2022-22123
• CVE-2022-22116
• CVE-2022-22124