CVE-2022-2921

Exposure of Private Personal Information to an Unauthorized Actor in notrinos/notrinoserp

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.

Affected

notrinos · notrinos/notrinoserp

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 HUNTR

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.36% chance of exploitation in the next 30 days, 71st percentile

Published

2022-08-21

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c

Security advisories

• notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45
• advisories/GHSA-44w5-q257-8428

References

• CVE Record
• NVD entry