cve/2022/CVE-2022-23067.md

### [CVE-2022-23067](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23067)
![](https://img.shields.io/static/v1?label=Product&message=ToolJet&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.5.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brighgreen)

### Description

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

### POC

#### Reference
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067

#### Github
No PoCs found on GitHub currently.