Vulnerabilities > CVE-2022-23067 - Unspecified vulnerability in Tooljet

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

tooljet

NVD

Published: 2022-05-18

Updated: 2024-11-21

Summary

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

Vulnerable Configurations

Part	Description	Count
Application	Tooljet Tooljet Tooljet 0.5.0 Tooljet Tooljet 0.5.1 Tooljet Tooljet 0.5.2 Tooljet Tooljet 0.5.3 Tooljet Tooljet 0.5.4 Tooljet Tooljet 0.5.5 Tooljet Tooljet 0.5.6 Tooljet Tooljet 0.5.7 Tooljet Tooljet 0.5.8 Tooljet Tooljet 0.5.9 Tooljet Tooljet 0.5.10 Tooljet Tooljet 0.5.11 Tooljet Tooljet 0.5.12 Tooljet Tooljet 0.5.13 Tooljet Tooljet 0.5.14 Tooljet Tooljet 0.6.0 Tooljet Tooljet 0.6.1 Tooljet Tooljet 0.7.0 Tooljet Tooljet 0.7.1 Tooljet Tooljet 0.7.2 Tooljet Tooljet 0.7.3 Tooljet Tooljet 0.7.4 Tooljet Tooljet 0.8.0 Tooljet Tooljet 0.8.1 Tooljet Tooljet 0.9.0 Tooljet Tooljet 0.9.1 Tooljet Tooljet 0.9.2 Tooljet Tooljet 0.9.3 Tooljet Tooljet 0.10.0 Tooljet Tooljet 0.10.1 Tooljet Tooljet 0.11.0 Tooljet Tooljet 0.11.1 Tooljet Tooljet 0.12.0 Tooljet Tooljet 0.12.1 Tooljet Tooljet 0.12.2 Tooljet Tooljet 0.12.3 Tooljet Tooljet 0.13.0 Tooljet Tooljet 0.13.1 Tooljet Tooljet 0.13.2 Tooljet Tooljet 0.13.3 Tooljet Tooljet 0.13.4 Tooljet Tooljet 0.13.6 Tooljet Tooljet 1.0 Tooljet Tooljet 1.0.1 Tooljet Tooljet 1.1.0 Tooljet Tooljet 1.2.0 Tooljet Tooljet 1.2.1 Tooljet Tooljet 1.2.2	51

Summary

Vulnerable Configurations

References