CVE-2022-34775 Tabit - Excessive data exposure

🗓️ 22 Aug 2022 14:42:21Reported by INCDType

CVE-2022-34775 Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2022-34775	17 Aug 202211:14	–	attackerkb
Circl	CVE-2022-34775	22 Aug 202218:20	–	circl
CNNVD	GTAB Software Tabit 安全漏洞	22 Aug 202200:00	–	cnnvd
CVE	CVE-2022-34775	22 Aug 202214:42	–	cve
EUVD	EUVD-2022-37723	3 Oct 202520:07	–	euvd
NVD	CVE-2022-34775	22 Aug 202215:15	–	nvd
Prion	Authentication flaw	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-22326 · Tabit · Tabit	22 Aug 202200:00	–	ptsecurity

[
  {
    "product": "Tabit",
    "vendor": "Tabit",
    "versions": [
      {
        "lessThan": "3.27.0*",
        "status": "affected",
        "version": "3.27.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gov	www.gov.il/en/departments/faq/cve_advisories

22 Aug 2022 14:42Current

7.6High risk

Vulners AI Score7.6

CVSS 3.16.3

EPSS0.00231