CVE-2022-32170

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.56% chance of exploitation in the next 30 days, 45th percentile

Published

2022-09-28

Updated

2025-05-21

Proof-of-concept exploits (2)

• https://www.mend.io/vulnerability-database/CVE-2022-32170
• advisories/GHSA-9mmc-27gw-w6mq

References

• CVE Record
• NVD entry

Related

• CVE-2022-3217
• CVE-2022-32173
• CVE-2022-32169
• CVE-2022-32174
• CVE-2022-32167
• CVE-2022-32175