CVE-2022-34776

Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its URL one or more MongoDB ID which is not so simple to enumerate. However, they each receive a 'tiny URL' in tabits domain, in the form of https://tbit.be/{suffix} with suffix being a 5 character long string containing numbers, lower and upper case letters. It is not so simple to enumerate them all, but really easy to find some that work and lead to a personal endpoint. Furthermore, the redirect URL disclosed the MongoDB IDs discussed above, and we could use them to query other endpoints disclosing more personal information.

• CWE-200

• https://www.gov.il/en/departments/faq/cve_advisoriesThird Party Advisory
• https://www.gov.il/en/departments/faq/cve_advisoriesThird Party Advisory

Published

Aug 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34770Tabit - sensitive information disclosure. Several APIs on th…7.5
• CVE-2022-34771Tabit - arbitrary SMS send on Tabits behalf. The resend OTP …3.5
• CVE-2022-34772Tabit - password enumeration. Description: Tabit - password …8.8
• CVE-2022-34773Tabit - HTTP Method manipulation. https://bridge.tabit.cloud…9.8
• CVE-2022-34774Tabit - Arbitrary account modification. One of the endpoints…5.3
• CVE-2022-34775Tabit - Excessive data exposure. Another endpoint mapped by …7.5
• CVE-2022-34777Jenkins GitLab Plugin 1.5.34 and earlier does not escape mul…5.4
• CVE-2022-34778Jenkins TestNG Results Plugin 554.va4a552116332 and earlier …5.4
• CVE-2022-34779A missing permission check in Jenkins XebiaLabs XL Release P…4.3
• CVE-2022-3478An issue has been discovered in GitLab affecting all version…4.3
• CVE-2022-34780A cross-site request forgery (CSRF) vulnerability in Jenkins…6.5
• CVE-2022-34781Missing permission checks in Jenkins XebiaLabs XL Release Pl…6.5