CVE-2022-2921: Exposure of Private Personal Information to an Unauthorized Actor

August 22, 2022 (updated August 30, 2022)

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.

References

github.com/advisories/GHSA-44w5-q257-8428
github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45
huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c
nvd.nist.gov/vuln/detail/CVE-2022-2921

Code Behaviors & Features

Detect and mitigate CVE-2022-2921 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →