PT-2022-14828 · Nocodb · Nocodb

Published 2022-06-13 · Updated 2025-08-26 · CVE-2022-2062

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.91.7

Description The issue concerns the generation of error messages containing sensitive information and the lack of verification or validation in the SMTP plugin. This allows attackers to make requests to internal servers and read the contents.

Recommendations For versions prior to 0.91.7, update to version 0.91.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the SMTP plugin until the update is applied.

Exploit

Fix

Information Disclosure

SSRF

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-918

CWE-209

Related Identifiers

CVE-2022-2062

GHSA-MX8Q-JQWM-85MV

Affected Products

Nocodb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2062.json · Exploit
• 🔥 https://huntr.dev/bounties/35593b4c-f127-4699-8ad3-f0b2203a8ef6 · Exploit
• https://github.com/nocodb/nocodb/commit/a18f5dd53811b9ec1c1bb2fdbfb328c0c87d7fb4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2062 · Security Note
• https://osv.dev/vulnerability/GHSA-mx8q-jqwm-85mv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2062 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://t.me/cveNotify/133550 · Telegram Post