CVE-2022-34770

🗓️ 22 Aug 2022 14:41:16Reported by INCDType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 343 Views🌐 WEB

Tabit - sensitive information disclosure through unauthorized APIs and MongoDB ID enumeratio

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2022-34770	17 Aug 202211:14	–	attackerkb
CNNVD	GTAB Software Tabit 安全漏洞	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-34770 Tabit - sensitive information disclosure	22 Aug 202214:41	–	cvelist
EUVD	EUVD-2022-37718	3 Oct 202520:07	–	euvd
NVD	CVE-2022-34770	22 Aug 202215:15	–	nvd
OSV	CVE-2022-34770	22 Aug 202215:15	–	osv
Prion	Authorization	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-22321 · Tabit · Tabit	22 Aug 202200:00	–	ptsecurity

NVD

Node

tabit tabitRange<3.27.0

[
  {
    "product": "Tabit",
    "vendor": "Tabit",
    "versions": [
      {
        "lessThan": "3.27.0*",
        "status": "affected",
        "version": "3.27.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gov	www.gov.il/en/departments/faq/cve_advisories

Parameter	Position	Path	Description	CWE
orgId	query param	/online-reservations/health-statement?orgId={org_id}&healthStatementId={health_statement_id}	Health statement endpoint discloses sensitive personal information due to insufficient access controls.	CWE-639
healthStatementId	query param	/online-reservations/health-statement?orgId={org_id}&healthStatementId={health_statement_id}	Health statement endpoint discloses sensitive personal information due to insufficient access controls.	CWE-639
health_statement_id	path	/health-statement/{health_statement_id}	Health statement API exposes medical information via a path parameter with possible improper authorization.	CWE-639
suffix	path	/{suffix}	Tiny URL redirect used to access privileged resources, enabling discovery of sensitive data through indirect endpoints.	CWE-639