CVE-2022-23067
on github
Published
Severity
CVSS v3:
8.8 HIGH
CVSS v2:
6.8 MEDIUM
Description
ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.
References
Configurations
CPE23 | Version Start | Version End | Exact Version |
---|---|---|---|
cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:* | 0.5.0 (including) | 1.2.2 (including) | * |