CVEvulnerability
CVE-2022-32170
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-09-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-285
Description
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
Affected configurations
• bytebase bytebase (>= 0.1.0 <= 1.0.4)
Related
Weakness · CWE (1)
- CWE-285 Improper Authorization weakness
References
- https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197 github.com
- https://www.mend.io/vulnerability-database/CVE-2022-32170 Exploit, Third Party Advisory
- https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197 github.com
- https://www.mend.io/vulnerability-database/CVE-2022-32170 Exploit, Third Party Advisory