cvelistv5 - cve-2022-28802

CVE-2022-28802 (GCVE-0-2022-28802)

Vulnerability from cvelistv5 – Published: 2022-09-21 19:46 – Updated: 2025-05-27 20:10

Summary

Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company's account, but was supposed to enforce role-based access control within that company's account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren't supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre

References

URL

Tags

	https://www.zenity.io/blog/zapescape-organization…	x_refsource_MISC
	https://www.zenity.io/blog/zapescape-vulnerabilit…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:03:53.046Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-28802",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-27T20:10:00.649850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-27T20:10:19.291Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-21T19:46:28.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-28802",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/",
              "refsource": "MISC",
              "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/"
            },
            {
              "name": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/",
              "refsource": "MISC",
              "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-28802",
    "datePublished": "2022-09-21T19:46:28.000Z",
    "dateReserved": "2022-04-08T00:00:00.000Z",
    "dateUpdated": "2025-05-27T20:10:19.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zapier:code_by_zapier:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2022-08-17\", \"matchCriteriaId\": \"0B4E1EBB-D5DC-4967-9B03-BB194D2DBEBE\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)\"}, {\"lang\": \"es\", \"value\": \"Code by Zapier versiones anteriores a 17-08-2022, permit\\u00eda una escalada de privilegios dentro de la cuenta que inclu\\u00eda una ejecuci\\u00f3n de c\\u00f3digo Python o JavaScript. En otras palabras, Code by Zapier estaba proporcionando una m\\u00e1quina virtual de prop\\u00f3sito general controlada por el cliente que involuntariamente otorgaba acceso completo a todos los usuarios de la cuenta de una empresa, pero supon\\u00eda que deb\\u00eda hacer cumplir el control de acceso basado en roles dentro de la cuenta de esa empresa. En versiones anteriores a 17-08-2022, un cliente podr\\u00eda haber resuelto esto usando (en efecto) una m\\u00e1quina virtual separada para una aplicaci\\u00f3n que contuviera credenciales -u otros secretos- que no deb\\u00edan ser compartidos entre todos sus empleados. (Se habr\\u00edan necesitado varias cuentas para operar estas m\\u00e1quinas virtuales independientes)\"}]",
      "id": "CVE-2022-28802",
      "lastModified": "2024-11-21T06:57:57.450",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.9, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.1, \"impactScore\": 6.0}]}",
      "published": "2022-09-21T20:15:10.027",
      "references": "[{\"url\": \"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-732\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-28802\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-09-21T20:15:10.027\",\"lastModified\":\"2025-05-27T20:15:22.553\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)\"},{\"lang\":\"es\",\"value\":\"Code by Zapier versiones anteriores a 17-08-2022, permit\u00eda una escalada de privilegios dentro de la cuenta que inclu\u00eda una ejecuci\u00f3n de c\u00f3digo Python o JavaScript. En otras palabras, Code by Zapier estaba proporcionando una m\u00e1quina virtual de prop\u00f3sito general controlada por el cliente que involuntariamente otorgaba acceso completo a todos los usuarios de la cuenta de una empresa, pero supon\u00eda que deb\u00eda hacer cumplir el control de acceso basado en roles dentro de la cuenta de esa empresa. En versiones anteriores a 17-08-2022, un cliente podr\u00eda haber resuelto esto usando (en efecto) una m\u00e1quina virtual separada para una aplicaci\u00f3n que contuviera credenciales -u otros secretos- que no deb\u00edan ser compartidos entre todos sus empleados. (Se habr\u00edan necesitado varias cuentas para operar estas m\u00e1quinas virtuales independientes)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zapier:code_by_zapier:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2022-08-17\",\"matchCriteriaId\":\"0B4E1EBB-D5DC-4967-9B03-BB194D2DBEBE\"}]}]}],\"references\":[{\"url\":\"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T06:03:53.046Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-28802\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-27T20:10:00.649850Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732 Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-27T20:10:13.765Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2022-09-21T19:46:28.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}, \"product_name\": \"n/a\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\", \"name\": \"https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\", \"name\": \"https://www.zenity.io/blog/zapescape-vulnerability-disclosure/\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-28802\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"cve@mitre.org\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-28802\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-27T20:10:19.291Z\", \"dateReserved\": \"2022-04-08T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2022-09-21T19:46:28.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2022-28802

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-28802

Aliases

CVE-2022-28802

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-28802",
    "id": "GSD-2022-28802"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-28802"
      ],
      "details": "Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)",
      "id": "GSD-2022-28802",
      "modified": "2023-12-13T01:19:34.354877Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2022-28802",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/",
            "refsource": "MISC",
            "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/"
          },
          {
            "name": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/",
            "refsource": "MISC",
            "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:zapier:code_by_zapier:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022-08-17",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-28802"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-732"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Vendor Advisory"
              ],
              "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/"
            },
            {
              "name": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Vendor Advisory"
              ],
              "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.1,
          "impactScore": 6.0
        }
      },
      "lastModifiedDate": "2022-09-26T18:49Z",
      "publishedDate": "2022-09-21T20:15Z"
    }
  }
}

GHSA-2G9M-CFMH-9R83

Vulnerability from github – Published: 2022-09-22 00:00 – Updated: 2025-05-27 21:32

Details

Severity ?

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-28802"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-21T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)",
  "id": "GHSA-2g9m-cfmh-9r83",
  "modified": "2025-05-27T21:32:03Z",
  "published": "2022-09-22T00:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28802"
    },
    {
      "type": "WEB",
      "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier"
    },
    {
      "type": "WEB",
      "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2022-28802

Vulnerability from fkie_nvd - Published: 2022-09-21 20:15 - Updated: 2025-05-27 20:15

Severity ?

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cve@mitre.org	https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/	Mitigation, Vendor Advisory
cve@mitre.org	https://www.zenity.io/blog/zapescape-vulnerability-disclosure/	Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/	Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.zenity.io/blog/zapescape-vulnerability-disclosure/	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	zapier	code_by_zapier	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zapier:code_by_zapier:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B4E1EBB-D5DC-4967-9B03-BB194D2DBEBE",
              "versionEndExcluding": "2022-08-17",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company\u0027s account, but was supposed to enforce role-based access control within that company\u0027s account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren\u0027t supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)"
    },
    {
      "lang": "es",
      "value": "Code by Zapier versiones anteriores a 17-08-2022, permit\u00eda una escalada de privilegios dentro de la cuenta que inclu\u00eda una ejecuci\u00f3n de c\u00f3digo Python o JavaScript. En otras palabras, Code by Zapier estaba proporcionando una m\u00e1quina virtual de prop\u00f3sito general controlada por el cliente que involuntariamente otorgaba acceso completo a todos los usuarios de la cuenta de una empresa, pero supon\u00eda que deb\u00eda hacer cumplir el control de acceso basado en roles dentro de la cuenta de esa empresa. En versiones anteriores a 17-08-2022, un cliente podr\u00eda haber resuelto esto usando (en efecto) una m\u00e1quina virtual separada para una aplicaci\u00f3n que contuviera credenciales -u otros secretos- que no deb\u00edan ser compartidos entre todos sus empleados. (Se habr\u00edan necesitado varias cuentas para operar estas m\u00e1quinas virtuales independientes)"
    }
  ],
  "id": "CVE-2022-28802",
  "lastModified": "2025-05-27T20:15:22.553",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-09-21T20:15:10.027",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.zenity.io/blog/zapescape-vulnerability-disclosure/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-28802 (GCVE-0-2022-28802)

GSD-2022-28802

GHSA-2G9M-CFMH-9R83

FKIE_CVE-2022-28802

Tags

Sightings

Nomenclature