CVE-2022-22120 MEDIUM

CVE-2022-22120: NocoDB - Observable Discrepancy in the password-reset feature

Vendor Nocodb
Product nocodb
Weakness CWE-203
Published January 10, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

Key dates

02Disclosure timeline

January 10, 2022 CVE published
September 16, 2024 Record updated