CVE-2022-34774

Tabit - Arbitrary account modification. One of the endpoints mapped by the tiny URL, was a page where an adversary can modify personal details, such as email addresses and phone numbers of a specific user in a restaurant's loyalty program. Possibly allowing account takeover (the mail can be used to reset password).

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.gov.il/en/departments/faq/cve_advisories	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tabit:tabit:*:*:*:*:*:*:*:*

History

28 Mar 2023, 18:11

Type	Values Removed	Values Added
First Time		Tabit Tabit tabit
CPE	cpe:2.3:a:tabit_technologies:tabit::::::::	cpe:2.3:a:tabit:tabit::::::::

26 Aug 2022, 14:46

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
First Time		Tabit Technologies Tabit Technologies tabit
CPE		cpe:2.3:a:tabit_technologies:tabit::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
References	~~(MISC) https://www.gov.il/en/departments/faq/cve_advisories -~~	(MISC) https://www.gov.il/en/departments/faq/cve_advisories - Third Party Advisory

22 Aug 2022, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-22 15:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-34774

Mitre link : CVE-2022-34774

CVE.ORG link : CVE-2022-34774

JSON object : View

Products Affected

tabit

tabit

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-34774", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@cyber.gov.il", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2022-08-22T15:15:16.293", "references": [{"url": "https://www.gov.il/en/departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "cna@cyber.gov.il"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Tabit - Arbitrary account modification. One of the endpoints mapped by the tiny URL, was a page where an adversary can modify personal details, such as email addresses and phone numbers of a specific user in a restaurant's loyalty program. Possibly allowing account takeover (the mail can be used to reset password)."}, {"lang": "es", "value": "Tabit - Modificaci\u00f3n arbitraria de cuentas. Uno de los endpoints mapeados por la diminuta URL, era una p\u00e1gina en la que un adversario puede modificar los datos personales, como las direcciones de correo electr\u00f3nico y los n\u00fameros de tel\u00e9fono de un usuario espec\u00edfico en el programa de fidelizaci\u00f3n de un restaurante. Posiblemente permitiendo una toma de control de la cuenta (el correo puede ser usado para restablecer la contrase\u00f1a)."}], "lastModified": "2023-03-28T18:11:11.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tabit:tabit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2DB843-28A9-4524-B84D-F714BF3DB9F6", "versionEndExcluding": "3.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cyber.gov.il"}