PT-2022-22326 · Tabit · Tabit

Published 2022-08-22 · Updated 2023-08-08 · CVE-2022-34775

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tabit (affected versions not specified)

Description The issue concerns excessive data exposure through an API endpoint. Specifically, the endpoint for reservation cancellation contains the MongoDB ID of the reservation and organization, which can be used to query the "http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId}" API endpoint. This endpoint returns sensitive information about the reservation, including name, email, phone number, visit history, spending habits, and deposit details. This information can be exploited for phishing attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-34775

Affected Products

Tabit

References · 4

• https://osv.dev/vulnerability/CVE-2022-34775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34775 · Security Note
• https://t.me/cibsecurity/48490 · Telegram Post
• https://gov.il/en/departments/faq/cve_advisories · Note