PT-2022-22086 · Nocodb · Nocodb

Published 2022-10-07 · Updated 2026-02-25 · CVE-2022-3423

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.92.0

Description The issue allows actors to cause a Denial of Service (DoS) by inserting large characters into the input field New Project on the create field via a crafted HTTP request.

Recommendations For versions prior to 0.92.0, update to version 0.92.0 to resolve the issue. As a temporary workaround, consider restricting access to the create field or limiting the input size for the New Project field until the update is applied.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2022-3423

GHSA-GRV6-M753-3W2G

Affected Products

Nocodb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3423.json · Exploit
• 🔥 https://huntr.dev/bounties/94639d8e-8301-4432-ab80-e76e1346e631 · Exploit
• https://github.com/nocodb/nocodb/commit/000ecd886738b965b5997cd905825e3244f48b95 · Patch
• https://osv.dev/vulnerability/CVE-2022-3423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3423 · Security Note
• https://osv.dev/vulnerability/GHSA-grv6-m753-3w2g · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://t.me/cveNotify/153177 · Telegram Post
• https://t.me/cibsecurity/50958 · Telegram Post