Lucene search

INCDCVE-2022-34775

HistoryAug 22, 2022 - 3:15 p.m.

CVE-2022-34775

2022-08-2215:15:16

CWE-639

INCD

web.nvd.nist.gov

311

tabit

cve-2022-34775

excessive data exposure

reservation cancellation

mongodb

api security

owasp

phishing attack

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack.

Affected configurations

Nvd

Node

tabittabitRange<3.27.0

VendorProductVersionCPE
tabittabit*cpe:2.3:a:tabit:tabit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tabit	tabit	*	cpe:2.3:a:tabit:tabit::::::::

CNA Affected

[
  {
    "product": "Tabit",
    "vendor": "Tabit",
    "versions": [
      {
        "lessThan": "3.27.0*",
        "status": "affected",
        "version": "3.27.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.gov.il/en/departments/faq/cve_advisories

Social References

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

Related for CVE-2022-34775