CVE-2022-34776

🗓️ 22 Aug 2022 14:42:38Reported by INCDType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 522 Views🌐 WEB

CVE-2022-34776: Tabit giftcard stealth, unauthorized disclosure of sensitive personal information via APIs and MongoDB IDs

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2022-34776	21 Aug 202211:14	–	attackerkb
CNNVD	GTAB Software Tabit 信息泄露漏洞	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-34776 Tabit - giftcard stealth	22 Aug 202214:42	–	cvelist
EUVD	EUVD-2022-37724	3 Oct 202520:07	–	euvd
NVD	CVE-2022-34776	22 Aug 202215:15	–	nvd
OSV	CVE-2022-34776	22 Aug 202215:15	–	osv
Prion	Authorization	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-22327 · Tabit · Tabit	22 Aug 202200:00	–	ptsecurity

NVD

Node

tabit tabitRange<3.27.0

[
  {
    "product": "Tabit",
    "vendor": "Tabit",
    "versions": [
      {
        "lessThan": "3.27.0*",
        "status": "affected",
        "version": "3.27.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gov	www.gov.il/en/departments/faq/cve_advisories

Parameter	Position	Path	Description	CWE
suffix	path	tbit.be/{suffix}	Exposed random 5-character tiny URL used to access personal endpoints leaking sensitive information; potential for unauthorized access via redirect to internal resources.	CWE-200