GHSA-mx8q-jqwm-85mv

Source

https://github.com/advisories/GHSA-mx8q-jqwm-85mv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-mx8q-jqwm-85mv/GHSA-mx8q-jqwm-85mv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mx8q-jqwm-85mv

Aliases

CVE-2022-2062

Published

2022-06-14T00:00:37Z

Modified

2023-11-08T04:08:03Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

NocoDB information disclosure vulnerability

Details

In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents.

Database specific

{
    "cwe_ids":  [
        "CWE-200",
        "CWE-209",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-06-30T20:40:22Z",
    "nvd_published_at":  "2022-06-13T12:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / nocodb

Package

Name: nocodb; View open source insights on deps.dev
Purl: pkg:npm/nocodb

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.91.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-mx8q-jqwm-85mv/GHSA-mx8q-jqwm-85mv.json"