CVE-2022-22120
NocoDB - Observable Discrepancy in the password-reset feature
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.
En NocoDB, versiones 0.9 a 0.83.8, son vulnerables a una Discrepancia Observable en la funcionalidad password-reset. Cuando es solicitado un restablecimiento de contraseña para una dirección de correo electrónico determinada, la aplicación muestra un mensaje de error cuando el correo electrónico no está registrado en el sistema. Esto permite a atacantes enumerar las direcciones de correo electrónico de usuarios registrados
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-12-21 CVE Reserved
- 2022-01-10 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-09-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-203: Observable Discrepancy
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120 | 2024-09-16 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/nocodb/nocodb/commit/f46e89b0 | 2022-01-19 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xgenecloud Search vendor "Xgenecloud" | Nocodb Search vendor "Xgenecloud" for product "Nocodb" | >= 0.9 <= 0.83.8 Search vendor "Xgenecloud" for product "Nocodb" and version " >= 0.9 <= 0.83.8" | - |
Affected
| ||||||