CVE-2022-3348 MEDIUM

CVE-2022-3348: Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet

Vendor Tooljet
Product tooljet/tooljet
Weakness CWE-200 · Info exposure
Published September 28, 2022
Last update May 21, 2025

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.

Key dates

02Disclosure timeline

September 28, 2022 CVE published
May 21, 2025 Record updated