CVE-2022-2062: NocoDB information disclosure vulnerability
Summary
CVE-2022-2062: NocoDB information disclosure vulnerability. Affects nocodb versions < 0.91.7. Fixed in 0.91.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source tool that provides a web-based interface for managing databases. It allows users to create, read, update, and delete data in various database systems. The vulnerability identified as CVE-2022-2062 affects NocoDB versions prior to 0.91.7. This vulnerability specifically impacts the SMTP plugin, which lacks proper verification and validation. As a result, attackers can exploit this vulnerability to make requests to internal servers and read their contents.
Vulnerability Detail
The vulnerability in NocoDB allows unauthorized access to internal servers and the ability to read sensitive information. By exploiting the lack of verification and validation in the SMTP plugin, attackers can send malicious requests that bypass security measures. This can lead to the exposure of confidential data stored in the internal servers, potentially compromising the privacy and integrity of the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.91.7
This is the first release that contains the fix.
npm install nocodb@0.91.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or remove the SMTP plugin from their NocoDB installation. This can be done by modifying the configuration files or disabling the plugin through the NocoDB administration interface. However, it is strongly advised to apply the official fix by upgrading to the latest version to fully mitigate the vulnerability.
Conclusion
The NocoDB information disclosure vulnerability (CVE-2022-2062) poses a significant risk to the confidentiality and integrity of affected systems. It allows unauthorized access to internal servers and the potential exposure of sensitive information. To mitigate this vulnerability, it is crucial to upgrade NocoDB to version 0.91.7 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nocodb →
FAQ
NocoDB is an open-source tool that provides a web-based interface for managing databases. It allows users to create, read, update, and delete data in various database systems.
The vulnerability allows attackers to make requests to internal servers and read their contents, potentially exposing sensitive information stored in the affected system.
To fix this vulnerability, it is recommended to upgrade NocoDB to version 0.91.7 or later, which includes the necessary fixes to address the information disclosure vulnerability.
As a temporary workaround, users can disable or remove the SMTP plugin from their NocoDB installation. However, it is strongly advised to apply the official fix by upgrading to the latest version.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
