CVE-2022-34775

Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.gov.il/en/departments/faq/cve_advisories	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tabit:tabit:*:*:*:*:*:*:*:*

History

08 Aug 2023, 14:21

Type	Values Removed	Values Added
CWE	~~CWE-668~~	CWE-639

Information

Published : 2022-08-22 15:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-34775

Mitre link : CVE-2022-34775

CVE.ORG link : CVE-2022-34775

JSON object : View

Products Affected

tabit

tabit

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2022-34775", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@cyber.gov.il", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2022-08-22T15:15:16.347", "references": [{"url": "https://www.gov.il/en/departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "cna@cyber.gov.il"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack."}, {"lang": "es", "value": "Tabit - Exposici\u00f3n excesiva de datos. Otro endpoint mapeado por la diminuta url, era uno para la cancelaci\u00f3n de reservas, que conten\u00eda el ID de MongoDB de la reserva, y la organizaci\u00f3n. Esto puede ser usado para consultar la API http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API que devuelve muchos datos sobre la reserva (OWASP: API3): Nombre, correo, n\u00famero de tel\u00e9fono, el n\u00famero de visitas del usuario a ese restaurante concreto, el dinero que ha gastado all\u00ed, el dinero que ha gastado en alcohol, si ha dejado un dep\u00f3sito, etc. Esta informaci\u00f3n puede usarse f\u00e1cilmente para un ataque de phishing."}], "lastModified": "2023-08-08T14:21:49.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tabit:tabit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2DB843-28A9-4524-B84D-F714BF3DB9F6", "versionEndExcluding": "3.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cyber.gov.il"}