CVE-2022-34776

🗓️ 22 Aug 2022 14:42:38Reported by INCDType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 556 Views🌐 WEB

CVE-2022-34776: Tabit giftcard stealth, unauthorized disclosure of sensitive personal information via APIs and MongoDB IDs

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2022-34776	21 Aug 202211:14	–	attackerkb
CNNVD	GTAB Software Tabit has a vulnerability related to information leakage.	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-34776 Tabit - giftcard stealth	22 Aug 202214:42	–	cvelist
EUVD	EUVD-2022-37724	3 Oct 202520:07	–	euvd
NVD	CVE-2022-34776	22 Aug 202215:15	–	nvd
osv_cve	CVE-2022-34776	22 Aug 202215:15	–	osv_cve
Prion	Authorization	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-22327 · Tabit · Tabit	22 Aug 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-34776: Exposure of Sensitive Information to an Unauthorized Actor	22 Aug 202200:00	–	rapid7

NVD

Vulners

Node

tabit tabitRange<3.27.0

[
  {
    "product": "Tabit",
    "vendor": "Tabit",
    "versions": [
      {
        "lessThan": "3.27.0*",
        "status": "affected",
        "version": "3.27.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gov	www.gov.il/en/departments/faq/cve_advisories

Parameter	Position	Path	Description	CWE
{suffix}	path	/{suffix}	The endpoint accepts a 5-character suffix that redirects to a personal endpoint containing sensitive information (health statements, bills, etc.) and discloses MongoDB IDs in the redirect URL.	CWE-200