GitHub Advisoryadvisory · npm

GHSA-mx8q-jqwm-85mv NocoDB information disclosure vulnerability

HIGH Published 2022-06-14 Modified 2023-06-30 Official page ↗
Aliases
CVE-2022-2062
Ecosystem
npm
Packages
nocodb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-209, CWE-918
Reviewed
2023-06-30

Affected packages

• npm nocodb: < 0.91.7 → fixed in 0.91.7

Description

In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents.

Related

Alias · CVE (1)

  • CVE-2022-2062 Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. vulnerability

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information weakness
  • CWE-918 Server-Side Request Forgery weakness

References