dbcve.org
TabitApplication

CVE-2022-34773

CRITICAL · 9.8 CVSS v3.1 Published 2022-08-22
Fix available
A fix is available. Upgrade to 3.27.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of OWASP:API8 – Injection.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

CVE-2022-34773 is an HTTP Method manipulation vulnerability in Tabit's cloud bridge API (bridge.tabit.cloud) at the /configuration/addresses-query endpoint. The vulnerability allows injection attacks via POST requests to add unauthorized addresses to the database, classified as OWASP API8 (Injection). The CVSS 9.8 indicates critical severity with potential for complete system compromise through unauthorized data manipulation.

MitigationImplement strict input validation and parameterized queries on the addresses-query endpoint, enforce proper authorization checks ensuring users can only modify their own address data, and validate HTTP method usage to prevent method manipulation attacks.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
TabitApplication
Affected:< 3.27.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify if Tabit Tabit software is deployed
    Review your application inventory or installed software list to confirm Tabit Tabit is in use. Check for processes or services named 'tabit' or look for tabit-related configuration files in your environment.
    Affected if Tabit Tabit software is present in your environment
  2. Determine the installed Tabit version
    Check the application's about page, package.json, or configuration file for the version number. If using a hosted Tabit service, contact your administrator or check the service dashboard for version information.
    Affected if The version is below 3.27.0 (any version < 3.27.0)
  3. Verify cloud bridge API accessibility
    Attempt to reach bridge.tabit.cloud from your network or check API access logs for connections to bridge.tabit.cloud. Review firewall or proxy logs for traffic to this domain.
    Affected if Your environment makes requests to or exposes bridge.tabit.cloud API
  4. Check if addresses-query endpoint is exposed
    Review your API gateway, firewall, or proxy configurations to determine if the /configuration/addresses-query endpoint on bridge.tabit.cloud is accessible. Test sending a request to this endpoint if authorized.
    Affected if The /configuration/addresses-query endpoint is reachable from your environment
  5. Inspect authorization controls on the endpoint
    Analyze authentication and authorization logs for the addresses-query endpoint. Review API access control policies to determine if proper authorization checks are enforced for address manipulation operations.
    Affected if No or weak authorization controls are enforced on the addresses-query endpoint, allowing unauthorized address additions

You are affected if your Tabit Tabit installation is version 3.27.0 or higher, the cloud bridge API at bridge.tabit.cloud is accessible, the /configuration/addresses-query endpoint is exposed, and proper authorization controls are not in place on that endpoint.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 3.27.0 or later
Fixed in 3.27.0
Interim mitigation

Implement strict input validation and parameterized queries on the addresses-query endpoint, enforce proper authorization checks ensuring users can only modify their own address data, and validate HTTP method usage to prevent method manipulation attacks.

Recommended fix Moderate confidence

Tabit 3.27.0

  1. 1. Obtain Tabit version 3.27.0 or later from the official vendor
  2. 2. Review the upgrade documentation provided by Tabit
  3. 3. Create a backup of the current Tabit installation and database
  4. 4. Deploy version 3.27.0 following the vendor's upgrade procedure
  5. 5. Verify the fix by testing the /configuration/addresses-query endpoint to confirm the injection vulnerability is resolved
  6. 6. Monitor logs for any unexpected behavior post-upgrade

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Tabit Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-34773 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-34773 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data