CVE-2022-34770

🗓️ 22 Aug 2022 14:41:16Reported by INCDType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 360 Views🌐 WEB

Tabit - sensitive information disclosure through unauthorized APIs and MongoDB ID enumeratio

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2022-34770	17 Aug 202211:14	–	attackerkb
CNNVD	GTAB Software Tabit 安全漏洞	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-34770 Tabit - sensitive information disclosure	22 Aug 202214:41	–	cvelist
EUVD	EUVD-2022-37718	3 Oct 202520:07	–	euvd
NVD	CVE-2022-34770	22 Aug 202215:15	–	nvd
OSV	CVE-2022-34770	22 Aug 202215:15	–	osv
Prion	Authorization	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-22321 · Tabit · Tabit	22 Aug 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-34770: Authorization Bypass Through User-Controlled Key	22 Aug 202200:00	–	rapid7

NVD

Vulners

Node

tabit tabitRange<3.27.0

[
  {
    "product": "Tabit",
    "vendor": "Tabit",
    "versions": [
      {
        "lessThan": "3.27.0*",
        "status": "affected",
        "version": "3.27.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gov	www.gov.il/en/departments/faq/cve_advisories

Parameter	Position	Path	Description	CWE
suffix	path	tbit.be/{suffix}	Tiny URL short path that maps to a personal data endpoint exposing sensitive information; susceptible to enumeration and unauthorized access via the suffix.	CWE-639
orgId	query param	tabitisrael.co.il/online-reservations/health-statement?orgId={org_id}&healthStatementId={healthStatementId}	Health statement retrieval endpoint that exposes health data when supplied a healthStatementId; indicates broken object level authorization.	CWE-639
healthStatementId	query param	tabitisrael.co.il/online-reservations/health-statement?orgId={org_id}&healthStatementId={healthStatementId}	Health statement retrieval endpoint that exposes health data when supplied a healthStatementId; indicates broken object level authorization.	CWE-639
health_statement_id	path	tgm-api.tabit.cloud/health-statement/{health_statement_id}	Health statement API that discloses medical information and ID number using the health_statement_id.	CWE-639