Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-85044
HistoryNov 30, 2022 - 12:00 a.m.

Airtable.js configuration error vulnerability

2022-11-3000:00:00
China National Vulnerability Database
www.cnvd.org.cn
2

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Airtable.js is an Airtable javascript client open sourced by Airtable. It provides a simple way to access data. Airtable.js versions prior to 0.11.6 contain a configuration error vulnerability that stems from a misconfiguration in the script that binds environment variables to the build target of the compiled package when the script is run. An attacker could exploit this vulnerability to modify a local user build of Airtable.js to contain the value of the AIRTABLE_API_KEY environment variable, and attach that value to the packaged code.

CPENameOperatorVersion
airtable airtable.jslt0.11.6

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Related for CNVD-2022-85044