CVE-2022-32169

{"id": "CVE-2022-32169", "cveTags": [], "metrics": {}, "published": "2022-09-28T10:15:09.653", "references": [{"url": "https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187", "source": "vulnerabilitylab@mend.io"}, {"url": "https://www.mend.io/vulnerability-database/CVE-2022-32169", "tags": ["Exploit", "Third Party Advisory"], "source": "vulnerabilitylab@mend.io"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}, {"type": "Secondary", "source": "vulnerabilitylab@mend.io", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "The \u201cBytebase\u201d application does not restrict low privilege user to access \u201cadmin issues\u201c for which an unauthorized user can view the \u201cOPEN\u201d and \u201cCLOSED\u201d issues by \u201cAdmin\u201d and the affected endpoint is \u201c/issue\u201d."}, {"lang": "es", "value": "La aplicaci\u00f3n \"Bytebase\" no restringe a usuarios poco privilegiados el acceso a \"admin issues\" para las que un usuario no autorizado puede ver las incidencias \"OPEN\" y \"CLOSE\" por \"Admin\" y el endpoint afectado es \"/issue\""}], "lastModified": "2023-11-07T03:47:44.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bytebase:bytebase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58D2B448-3301-48A8-8796-C8FDA52268A6", "versionEndIncluding": "1.0.4", "versionStartIncluding": "0.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilitylab@mend.io"}