CVE-2022-32170

The Bytebase application does not restrict low privilege user to access admin projects for which an unauthorized user can view the projects created by Admin and the affected endpoint is /api/project?user=${userId}.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
MendCNA
---
---
CVEADP
---
---
CISA-ADPADP
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
VendorProductVersion
bytebasebytebase
0.1.0 ≤
𝑥
≤ 1.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197
https://www.mend.io/vulnerability-database/CVE-2022-32170
https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197
https://www.mend.io/vulnerability-database/CVE-2022-32170