ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter.
References
| Link | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/238543 | Third Party Advisory VDB Entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/238543 | Third Party Advisory VDB Entry |
| https://thingsboard.io/docs/reference/releases/ | Release Notes |
| https://thingsboard.io/docs/reference/releases/ | Release Notes |
Configurations
History
12 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/238543 - Third Party Advisory, VDB Entry | |
| References | () https://thingsboard.io/docs/reference/releases/ - Release Notes |
Information
Published : 2023-02-23 06:15
Updated : 2025-03-12 15:15
NVD link : CVE-2022-48341
Mitre link : CVE-2022-48341
JSON object : View
Products Affected
thingsboard
- thingsboard
CWE