CVE-2022-2063: Improper Privilege Management in NocoDB
8.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.76225%
CWE
Published
6/14/2022
Updated
1/27/2023
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nocodb | npm | < 0.91.8 | 0.91.8 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from user context being improperly included in webhook template processing. The patch removes all user parameter references from:
- parseBody's function signature and template context
- axiosRequestMake's parameter handling
- invokeWebhook's notification payload construction
- Documentation about user variables in webhooks.md This demonstrates these functions were responsible for exposing privileged user information through webhook contexts, violating least-privilege principles. The high confidence comes from direct evidence in commit diffs showing user data flow removal from these specific functions.