CVE-2022-32170

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197
https://www.mend.io/vulnerability-database/CVE-2022-32170	Exploit Third Party Advisory
https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197
https://www.mend.io/vulnerability-database/CVE-2022-32170	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bytebase:bytebase:*:*:*:*:*:*:*:*

History

21 May 2025, 14:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3

21 Nov 2024, 07:05

Type	Values Removed	Values Added
References	~~() https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197 -~~	() https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197 -
References	~~() https://www.mend.io/vulnerability-database/CVE-2022-32170 - Exploit, Third Party Advisory~~	() https://www.mend.io/vulnerability-database/CVE-2022-32170 - Exploit, Third Party Advisory

Information

Published : 2022-09-28 10:15

Updated : 2025-05-21 14:15

NVD link : CVE-2022-32170

Mitre link : CVE-2022-32170

CVE.ORG link : CVE-2022-32170

JSON object : View

Products Affected

bytebase

bytebase

CWE

CWE-285

Improper Authorization

{"id": "CVE-2022-32170", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-09-28T10:15:09.740", "references": [{"url": "https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197", "source": "vulnerabilitylab@mend.io"}, {"url": "https://www.mend.io/vulnerability-database/CVE-2022-32170", "tags": ["Exploit", "Third Party Advisory"], "source": "vulnerabilitylab@mend.io"}, {"url": "https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mend.io/vulnerability-database/CVE-2022-32170", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "vulnerabilitylab@mend.io", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "The \u201cBytebase\u201d application does not restrict low privilege user to access admin \u201cprojects\u201c for which an unauthorized user can view the \u201cprojects\u201c created by \u201cAdmin\u201d and the affected endpoint is \u201c/api/project?user=${userId}\u201d."}, {"lang": "es", "value": "La aplicaci\u00f3n \"Bytebase\" no restringe a usuarios poco privilegiados el acceso a \"projects\" del administrador, por lo que un usuario no autorizado puede visualizar \"projects\" creados por \"Admin\" y el endpoint afectado es \"/api/project?user=${userId}\""}], "lastModified": "2025-05-21T14:15:24.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bytebase:bytebase:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58D2B448-3301-48A8-8796-C8FDA52268A6", "versionEndIncluding": "1.0.4", "versionStartIncluding": "0.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilitylab@mend.io"}