CVE-2022-31164
Last modified
CVE-2022-31164 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. The problem has been patched in version 0.7.51.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tovyblox | Tovy | < 0.7.51 |
References
- https://github.com/tovyblox/tovy/pull/63Patch, Third Party Advisory
- https://github.com/tovyblox/tovy/security/advisories/GHSA-j6f8-wh4v-jc37Third Party Advisory
- https://github.com/tovyblox/tovy/pull/63Patch, Third Party Advisory
- https://github.com/tovyblox/tovy/security/advisories/GHSA-j6f8-wh4v-jc37Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-31164?
How severe is CVE-2022-31164?
How do I fix CVE-2022-31164?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-31159The AWS SDK for Java enables Java developers to work with Am…6.5
- CVE-2022-3116The Heimdal Software Kerberos 5 implementation is vulnerable…7.5
- CVE-2022-31160jQuery UI is a curated set of user interface interactions, e…6.1
- CVE-2022-31161Roxy-WI is a Web interface for managing HAProxy, Nginx and K…9.8
- CVE-2022-31162Slack Morphism is an async client library for Rust. Prior to…7.5
- CVE-2022-31163TZInfo is a Ruby library that provides access to time zone d…8.1
- CVE-2022-31166XWiki Platform Old Core is a core package for XWiki Platform…8.8
- CVE-2022-31167XWiki Platform Security Parent POM contains the security API…6.5
- CVE-2022-31168Zulip is an open source team chat tool. Due to an incorrect …8.8
- CVE-2022-31169Wasmtime is a standalone runtime for WebAssembly. There is a…7.5
- CVE-2022-3117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-31170OpenZeppelin Contracts is a library for smart contract devel…7.5
Are you affected by CVE-2022-31164?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST