CVE-2022-34774

{"id": "CVE-2022-34774", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@cyber.gov.il", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-08-22T15:15:16.293", "references": [{"url": "https://www.gov.il/en/departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "cna@cyber.gov.il"}, {"url": "https://www.gov.il/en/departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Tabit - Arbitrary account modification. One of the endpoints mapped by the tiny URL, was a page where an adversary can modify personal details, such as email addresses and phone numbers of a specific user in a restaurant's loyalty program. Possibly allowing account takeover (the mail can be used to reset password)."}, {"lang": "es", "value": "Tabit - Modificaci\u00f3n arbitraria de cuentas. Uno de los endpoints mapeados por la diminuta URL, era una p\u00e1gina en la que un adversario puede modificar los datos personales, como las direcciones de correo electr\u00f3nico y los n\u00fameros de tel\u00e9fono de un usuario espec\u00edfico en el programa de fidelizaci\u00f3n de un restaurante. Posiblemente permitiendo una toma de control de la cuenta (el correo puede ser usado para restablecer la contrase\u00f1a)."}], "lastModified": "2024-11-21T07:10:09.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tabit:tabit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2DB843-28A9-4524-B84D-F714BF3DB9F6", "versionEndExcluding": "3.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cyber.gov.il"}