CVE-2022-32169

The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187
https://www.mend.io/vulnerability-database/CVE-2022-32169	Exploit Third Party Advisory
https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187
https://www.mend.io/vulnerability-database/CVE-2022-32169	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bytebase:bytebase:*:*:*:*:*:*:*:*

History

21 May 2025, 14:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3

21 Nov 2024, 07:05

Type	Values Removed	Values Added
References	~~() https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187 -~~	() https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187 -
References	~~() https://www.mend.io/vulnerability-database/CVE-2022-32169 - Exploit, Third Party Advisory~~	() https://www.mend.io/vulnerability-database/CVE-2022-32169 - Exploit, Third Party Advisory

Information

Published : 2022-09-28 10:15

Updated : 2025-05-21 14:15

NVD link : CVE-2022-32169

Mitre link : CVE-2022-32169

CVE.ORG link : CVE-2022-32169

JSON object : View

Products Affected

bytebase

bytebase

CWE

CWE-285

Improper Authorization

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2022-32169", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-09-28T10:15:09.653", "references": [{"url": "https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187", "source": "vulnerabilitylab@mend.io"}, {"url": "https://www.mend.io/vulnerability-database/CVE-2022-32169", "tags": ["Exploit", "Third Party Advisory"], "source": "vulnerabilitylab@mend.io"}, {"url": "https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mend.io/vulnerability-database/CVE-2022-32169", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "vulnerabilitylab@mend.io", "description": [{"lang": "en", "value": "CWE-285"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "The \u201cBytebase\u201d application does not restrict low privilege user to access \u201cadmin issues\u201c for which an unauthorized user can view the \u201cOPEN\u201d and \u201cCLOSED\u201d issues by \u201cAdmin\u201d and the affected endpoint is \u201c/issue\u201d."}, {"lang": "es", "value": "La aplicaci\u00f3n \"Bytebase\" no restringe a usuarios poco privilegiados el acceso a \"admin issues\" para las que un usuario no autorizado puede ver las incidencias \"OPEN\" y \"CLOSE\" por \"Admin\" y el endpoint afectado es \"/issue\""}], "lastModified": "2025-05-21T14:15:24.703", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bytebase:bytebase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58D2B448-3301-48A8-8796-C8FDA52268A6", "versionEndIncluding": "1.0.4", "versionStartIncluding": "0.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilitylab@mend.io"}