CVE-2022-3348

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
tooljet	tooljet/tooljet	>= unspecified, < v1.26.0

References

https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a81888810488b913863a46Patch, Third Party Advisory
https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eacExploit, Patch, Third Party Advisory
https://github.com/tooljet/tooljet/commit/37bf6de75f161e03c2a81888810488b913863a46Patch, Third Party Advisory
https://huntr.dev/bounties/aae4aeb8-2612-4254-85e5-90675b082eacExploit, Patch, Third Party Advisory

Timeline

Published: Sep 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-33496.8A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the co CVE-2022-33504.8The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege us CVE-2022-33514.3An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15 CVE-2022-33527.8Use After Free in GitHub repository vim/vim prior to 9.0.0614.CVE-2022-33537.5A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the v CVE-2022-33547.5A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library CVE-2022-33555.4Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.CVE-2022-33578.8The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection i CVE-2022-33587.5OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was dep CVE-2022-33598.8The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could l CVE-2022-33608.1The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which coul CVE-2022-33614.3The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient inp