PT-2022-15256 · Nocodb · Nocodb

Published 2022-01-10 · Updated 2025-08-26 · CVE-2022-22120

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions 0.9 to 0.83.8

Description The issue concerns an Observable Discrepancy in the password-reset feature. When a password reset is requested for a given email address, the application displays an error message if the email is not registered within the system. This behavior allows attackers to enumerate the registered users' email addresses by observing the different responses to password reset requests for various email addresses.

Recommendations For NocoDB versions 0.9 to 0.83.8, consider temporarily modifying the password-reset feature to return a generic response for all password reset requests, regardless of whether the email address is registered or not, until a patch is available. Restrict access to the password-reset functionality to minimize the risk of exploitation.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2022-22120

Affected Products

Nocodb

References · 5

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2022-22120 · Exploit
• https://github.com/nocodb/nocodb/commit/f46e89b0 · Patch
• https://osv.dev/vulnerability/CVE-2022-22120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22120 · Security Note
• https://t.me/cveNotify/133547 · Telegram Post