3 results · Clear filters · Feed
-
Medium 6.5
Budibase server before 3.45.0 Cross-Tenant Information Disclosure
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can sup…
-
Medium 5.5
Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing databas…
-
Medium 5.4
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submi…