PT-2023-13003 · Talend · Talend Administration Center

Alexis Pain · Published 2023-01-10 · Updated 2024-07-03 · CVE-2022-30332

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Talend Administration Center version 7.3.1.20200219

Description The Forgot Password feature in the affected software provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests to the Forgot Password feature.

Recommendations For Talend Administration Center version 7.3.1.20200219, update to a version that includes the fix for the issue, specifically after TAC-15950, to resolve the account enumeration vulnerability. As a temporary workaround, consider restricting access to the Forgot Password feature to minimize the risk of exploitation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2022-30332

Affected Products

Talend Administration Center

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-30332 · Security Note
• https://help.talend.com/r/62tbPt7y~tPTxAB7y7KpeQ/H45WqEF32geNEZiGJnRwmw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30332 · Vendor Advisory
• https://cwe.mitre.org/data/definitions/204.html · Note
• https://excellium-services.com/cert-xlm-advisory/CVE-2022-30332 · Note
• https://t.me/cvenotify/42279 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-30332 · Note
• https://t.me/cvenotify/82026 · Telegram Post
• https://t.me/cvenotify/83630 · Telegram Post