CVE-2022-2062
Generation of Error Message Containing Sensitive Information in nocodb/nocodb
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Generation of Error Message Containing Sensitive Information in nocodb/nocodb
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Record
CVE-2022-2062- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2022-6100
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Record
EUVD-2022-6100- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mx8q-jqwm-85mv
NocoDB information disclosure vulnerability
In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents.
- Record
GHSA-mx8q-jqwm-85mv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-209, CWE-918
- Updated
- 2026-11-02
NVD
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Record
CVE-2022-2062- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
Generation of Error Message Containing Sensitive Information in nocodb/nocodb
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
- Record
CVE-2022-2062- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-mx8q-jqwm-85mv
NocoDB information disclosure vulnerability
In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents.
- Record
GHSA-mx8q-jqwm-85mv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-209, CWE-918
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nocodbnpm |
before 0.91.7 | 0.91.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2062 is a critical vulnerability (CVSS 9.1) in Nocodb, published June 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in nocodb 0.91.7.
References
huntr.dev/bounties/35593b4c-f127-4699-8ad3-f0b2203a8ef6
github.com/nocodb/nocodb/commit/a18f5dd53811b9ec1c1bb2fdbfb328c0c87d7fb4
nvd.nist.gov/vuln/detail/CVE-2022-2062