CVE-2022-23068

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-23068

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23068.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-23068

Published

2022-05-18T11:45:15.156Z

Modified

2026-07-15T01:49:11.369553236Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

ToolJet - HTML Injection in Invite New User

Details

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.

Database specific

{
    "cna_assigner": "Mend",
    "cwe_ids": [
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23068.json"
}

References

Affected packages

Git / github.com/tooljet/tooljet

Affected ranges

Type

GIT

Repo

https://github.com/tooljet/tooljet

Events

Introduced

1773ea5d4ec2ce54fd34d236f11625bcc50c5109

Fixed

431dc961cdfe4d26343d1c1c951ced778fbddb58

Database specific

{
    "cpe": "cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "last_affected": "1.10.2"
        }
    ]
}

Affected versions

0.*

0.6.0

Other

fix-csp

fix-image

fix-pg-queries

v0.*

v0.10.0

v0.10.0-hotfix.1

v0.10.1

v0.10.1-hotfix.1

v0.11.0

v0.12.0

v0.12.1

v0.13.0

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8.0

v0.8.1

v0.8.1-ee.1.0.0

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.3-hotfix.2

v1.*

v1.10.0

v1.5.0

v1.5.1

v1.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23068.json"