PT-2022-14842 · Nocodb · Nocodb

Published 2022-06-14 · Updated 2022-06-22 · CVE-2022-2079

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions nocodb/nocodb versions prior to 0.91.7+

Description The issue is related to Cross-site Scripting (XSS) - Stored, which affects the nocodb/nocodb GitHub repository.

Recommendations For versions prior to 0.91.7+, update to version 0.91.7 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-2079

GHSA-HV6Q-5G4F-8897

Affected Products

Nocodb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2079.json · Exploit
• 🔥 https://huntr.dev/bounties/2615adf2-ff40-4623-97fb-2e4a3800202a · Exploit
• https://github.com/nocodb/nocodb/commit/362f8f0869989bc13bdcd66c6fc9c86ac79b9992 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2079 · Security Note
• https://osv.dev/vulnerability/GHSA-hv6q-5g4f-8897 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2079 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/issues/2262 · Note
• https://github.com/nocodb/nocodb/releases · Note
• https://github.com/nocodb/nocodb/pull/2343 · Note
• https://t.me/cvenotify/31564 · Telegram Post