CVE-2022-3348

Published: Sep 28, 2022Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.

Affected (1)

Products: Tooljet: Tooljet

Tooljet

1 product

Tooljet

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tooljet Tooljet	Before 2022-09-11

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a81888810488b913863a46

Source: security@huntr.dev

PatchThird Party Advisory

https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eac

Source: security@huntr.dev

ExploitPatchThird Party Advisory

https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a81888810488b913863a46

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eac

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

Timeline

No history available yet.