PT-2022-15826
CVE-2022-23067
·
تاريخ النشر
2022-05-18
·
تاريخ التحديث
2022-05-26
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ToolJet versions v0.5.0 to v1.2.2
Description
The issue allows for token leakage via the Referer header, leading to account takeover. When a user opens an invite link or signup link and then clicks on external links within the page, the password set token or signup token is leaked in the Referer header. An attacker can use these tokens to access the user's account.
Recommendations
For ToolJet versions v0.5.0 to v1.2.2, consider restricting access to external links within the invite link/signup link page until a fix is available. As a temporary workaround, avoid using the invite link/signup link feature to minimize the risk of token leakage.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾