CVE-2022-22120

NocoDB - Observable Discrepancy in the password-reset feature

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

Affected

nocodb

CVSS v3.1 MEND

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.37% chance of exploitation in the next 30 days, 71st percentile

Published

2022-01-10

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120

Security advisories

• nocodb/nocodb/commit/f46e89b0

References

• CVE Record
• NVD entry