CVE-2022-32170

2022-09-2810:15:09

CWE-285

[email protected]

web.nvd.nist.gov

291

cve-2022-32170

bytebase

application security

unauthorized access

admin projects

low privilege user

nvd

vulnerability

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.8%

JSON

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.

Affected configurations

NVD

Node

bytebasebytebaseRange0.1.0–1.0.4

CPENameOperatorVersion
bytebase:bytebasebytebasele1.0.4

CPE	Name	Operator	Version
bytebase:bytebase	bytebase	le	1.0.4

CNA Affected

[
  {
    "product": "bytebase",
    "vendor": "bytebase",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.1.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "1.0.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]