{"id":"CVE-2022-2921","aliases":["EUVD-2022-6475","GHSA-44w5-q257-8428"],"status":"published","title":"Exposure of Private Personal Information to an Unauthorized Actor in notrinos/notrinoserp","description":"Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01399,"percentile":0.72666,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-359"],"published":"2022-08-21T03:15:20Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Packagist","package":"notrinos/notrinos-erp","fixed_in":["0.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"notrinos/notrinos-erp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"notrinos/notrinos-erp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7"}]}],"versions":["0.6"]}],"products":[{"vendor":"notrinos","product":"notrinos/notrinoserp"},{"vendor":"notrinos","product":"notrinoserp"}],"references":[{"url":"https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2921","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-44w5-q257-8428"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2921.json","tags":["advisory"]},{"url":"https://github.com/notrinos/NotrinosERP","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-2921","title":"Exposure of Private Personal Information to an Unauthorized Actor in notrinos/notrinoserp","description":"Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.","status":"published","published":"2022-08-21T03:15:20Z","modified":"2024-08-03T00:52:59.889Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-6475","description":"Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.","status":"published","published":"2022-08-21T03:15:20Z","modified":"2024-08-03T00:52:59Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:57.460299Z"}],"ghsa":[{"id":"GHSA-44w5-q257-8428","title":"Exposure of password hashes in notrinos/notrinos-erp","description":"The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.","status":"published","published":"2022-08-22T00:00:52Z","modified":"2023-01-28T05:01:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:36:23.433782Z"}],"nvd":[{"id":"CVE-2022-2921","description":"Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.","status":"published","published":"2022-08-21T04:15:10.703Z","modified":"2026-06-17T04:42:49.36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"CVE-2022-2921","title":"Exposure of Private Personal Information to an Unauthorized Actor in notrinos/notrinoserp","description":"Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.","status":"published","published":"2022-08-21T03:15:20Z","modified":"2026-10-28T02:30:57.214819415Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GHSA-44w5-q257-8428","title":"Exposure of password hashes in notrinos/notrinos-erp","description":"The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.","status":"published","published":"2022-08-22T00:00:52Z","modified":"2023-11-08T04:09:10.574701Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T15:46:36.434231Z"}]}}