CVE-2022-34770

🗓️ 22 Aug 2022 14:41:16Reported by INCDType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 363 Views🌐 WEB

Tabit - sensitive information disclosure through unauthorized APIs and MongoDB ID enumeratio

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2022-34770	17 Aug 202211:14	–	attackerkb
CNNVD	GTAB Software Tabit security vulnerabilities	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-34770 Tabit - sensitive information disclosure	22 Aug 202214:41	–	cvelist
EUVD	EUVD-2022-37718	3 Oct 202520:07	–	euvd
NVD	CVE-2022-34770	22 Aug 202215:15	–	nvd
osv_cve	CVE-2022-34770	22 Aug 202215:15	–	osv_cve
Prion	Authorization	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-22321 · Tabit · Tabit	22 Aug 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-34770: Authorization Bypass Through User-Controlled Key	22 Aug 202200:00	–	rapid7

NVD

Vulners

Node

tabit tabitRange<3.27.0

[
  {
    "product": "Tabit",
    "vendor": "Tabit",
    "versions": [
      {
        "lessThan": "3.27.0*",
        "status": "affected",
        "version": "3.27.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gov	www.gov.il/en/departments/faq/cve_advisories

Parameter	Position	Path	Description	CWE
orgId	query param	/online-reservations/health-statement	API endpoint that discloses sensitive health statements without proper authorization.	CWE-639
healthStatementId	query param	/online-reservations/health-statement	API endpoint that discloses sensitive health statements without proper authorization.	CWE-639
health_statement_id	path	/health-statement/{health_statement_id}	API endpoint disclosing medical information and ID numbers via a health_statement_id.	CWE-639