CVE-2022-2921

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-2921
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45 Patch Third Party Advisory
https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c Exploit Patch Third Party Advisory
https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45 Patch Third Party Advisory
https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c Exploit Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:notrinos:notrinoserp:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:01

Type Values Removed Values Added
References () https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45 - Patch, Third Party Advisory () https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45 - Patch, Third Party Advisory
References () https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c - Exploit, Patch, Third Party Advisory () https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c - Exploit, Patch, Third Party Advisory

23 Aug 2022, 16:09

Type Values Removed Values Added
CPE cpe:2.3:a:notrinos:notrinoserp:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References (CONFIRM) https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c - (CONFIRM) https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c - Exploit, Patch, Third Party Advisory
References (MISC) https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45 - (MISC) https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45 - Patch, Third Party Advisory

21 Aug 2022, 06:15

Type Values Removed Values Added
Summary This will lead to privilege escalation from AP officers account to the System Administrator account. and gain more functionality such as Create/Update Companies. Install/Update Languages. Install/Activate Extensions. Install/Activate Themes. Install/Activate Chart of Accounts. Software Upgrade. Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.

21 Aug 2022, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-21 04:15

Updated : 2024-11-21 07:01

NVD link : CVE-2022-2921

Mitre link : CVE-2022-2921

CVE.ORG link : CVE-2022-2921

JSON object : View

Products Affected

notrinos

  • notrinoserp
CWE
CWE-359

Exposure of Private Personal Information to an Unauthorized Actor