CVE-2022-27978
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
HIGH · CVSS 7.5
EPSS 0.00623
Act now
- Public exploit or PoC is available
- SSVC automatable: yes - attacks can be scripted at scale
- CVSS base score ≥ 7.0
Sigma rules0
YARA rules0