CVE-2022-32170

Summary

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.

Affected Software

Weaknesses

• CWE-285: CWE-285 Improper Authorization

ADP Enrichment

CVE Program Container

Additional References

• https://www.mend.io/vulnerability-database/CVE-2022-32170
• https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://www.mend.io/vulnerability-database/CVE-2022-32170
• https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197

• ←Previous
• Next→