CVE-2022-3348
Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
- Record
CVE-2022-3348- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-42733
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
- Record
EUVD-2022-42733- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xr6p-m6mj-h42c
Just like in the previous report, an attacker could steal the account of different users. But in...
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
- Record
GHSA-xr6p-m6mj-h42c- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
- Record
CVE-2022-3348- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
- Record
CVE-2022-3348- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3348 is a medium vulnerability (CVSS 6.5) in Tooljet, published September 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. No source names a fixed version.