CVE-2022-3019

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-639

Affected software

VendorProductVersions
tooljettooljet/tooljet>= unspecified, < 1.23.0

References

Timeline

Published
Aug 29, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-301907.8A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attackerCVE-2022-301928.3Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-301937.8AV1 Video Extension Remote Code Execution VulnerabilityCVE-2022-301947.5Windows WebBrowser Control Remote Code Execution VulnerabilityCVE-2022-301968.2Windows Secure Channel Denial of Service VulnerabilityCVE-2022-301975.5Windows Kernel Information Disclosure VulnerabilityCVE-2022-301988.1Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCVE-2022-302007.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityCVE-2022-302027.0Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityCVE-2022-302037.4Windows Boot Manager Security Feature Bypass VulnerabilityCVE-2022-302056.6Windows Group Policy Elevation of Privilege VulnerabilityCVE-2022-302067.8Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-3019: High severity, CVSS 8.8 | Vulnix