Improper Access Control in tooljet/tooljet
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.7%
probabilidade de exploração
0.7%top 50% das CVEs
exploração observada
nãonenhuma fonte reporta
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
tooljet · tooljet/tooljet