PT-2022-22327 · Tabit · Tabit

Published 2022-08-22 · Updated 2023-03-28 · CVE-2022-34776

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tabit (affected versions not specified)

Description The issue concerns several APIs on the web system that display sensitive information without authorization, including health statements, previous bills in a specific restaurant, alcohol consumption, and smoking habits. These APIs contain MongoDB IDs in their URLs, which can be difficult to enumerate. However, they can be accessed through "tiny URLs" in the form of https://tbit.be/{suffix}, where the suffix is a 5-character string containing numbers, lower and upper case letters. Although enumerating all possible suffixes may be challenging, it is relatively easy to find some that work and lead to personal endpoints. The redirect URL discloses the MongoDB IDs, which can then be used to query other endpoints and disclose more personal information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-34776

Affected Products

Tabit

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-34776 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34776 · Vendor Advisory
• https://gov.il/en/departments/faq/cve_advisories · Note