Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
The product does not handle or incorrectly handles an exceptional condition.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tooljet | Tooljet | 1.6 (including) | 1.6 (including) |