Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-32169
CVE-2022-32169:
vulnerability analysis and mitigation
Overview
The vulnerability (CVE-2022-32169) affects the Bytebase application versions 0.1.0 through 1.0.4. It was discovered and disclosed on September 28, 2022. The vulnerability is related to improper authorization controls where low-privilege users can access admin issues (Mend Database).
Technical details
The vulnerability is classified with a CVSS v3.1 Base Score of 4.3 (Low severity) with the following metrics: Attack Vector (Network), Attack Complexity (Low), Privileges Required (Low), User Interaction (None), Scope (Unchanged), Confidentiality (Low), Integrity (None), and Availability (None). The weakness is categorized under CWE-285 (Improper Authorization) and CWE-732 (Incorrect Permission Assignment for Critical Resource) (Mend Database).
Impact
The vulnerability allows unauthorized users with low privileges to view both 'OPEN' and 'CLOSED' issues created by administrators through the '/issue' endpoint. This results in unauthorized access to potentially sensitive information managed by administrators (Mend Database).
Mitigation and workarounds
At the time of disclosure, no official fix or mitigation was available for this vulnerability. Users of affected versions (0.1.0 through 1.0.4) should monitor for updates from the vendor (Mend Database).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management