CVE-2022-34771

Tabit - arbitrary SMS send on Tabits behalf

State: Published
Severity: 5.5 Medium
Published: Aug 22, 2022
Updated: Sep 16, 2024
Reserved: Jun 29, 2022

Description

Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the system. In addition, the API probably has some kind of template injection potential. When entering {{OTP}} in the custom message field it is formatted into an OTP.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	INCD

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
TabitTabit	3.27.0 to before 3.27.0*Affected

References

https://www.gov.il/en/departments/faq/cve_advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.