CVE-2022-23068

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.

Score

CVSS 3.1 5.4 Medium

Status

Modified - vulnerabilitylab@mend.io

Published

2022-05-18

Last modified

2024-09-17

Weaknesses

CWE-74, CWE-79

Affected products

• Tooljet (Tooljet)

References

• https://github.com/ToolJet/ToolJet/commit/431dc961cdfe4d26343d1c1c951ced778fbddb58
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23068