CVE-2022-32169

Summary

The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.

Affected Software

Weaknesses

• CWE-285: CWE-285 Improper Authorization

ADP Enrichment

CVE Program Container

Additional References

• https://www.mend.io/vulnerability-database/CVE-2022-32169
• https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://www.mend.io/vulnerability-database/CVE-2022-32169
• https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187

• ←Previous
• Next→