CVE-2022-22120 - CVE House
Back to Database
Status published Medium CVE-2022-22120

NocoDB - Observable Discrepancy in the password-reset feature

Vulnerability Description

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-22120

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • WhiteSource Vulnerability Research Team (WVR)

References

More from nocodb

View All →
CVE-2025-27506
NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
Medium 5.4
CVE-2023-5104
Improper Input Validation in nocodb/nocodb
Medium 5.7
CVE-2023-50718
NocoDB SQL Injection vulnerability
Medium 6.5
CVE-2023-50717
NocoDB Allows Preview of File with Dangerous Content
Medium 5.7
CVE-2023-49781
NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue
High 7.3

Affected Vendor

Affected Software

nocodb
Vulnerable Versions:
0.9, unspecified

Timeline

Official Publish: January 10th, 2022
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-203

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1046 Network Service Discovery
Discovery