VulnerabilityPublished 10 Jan 2023Updated 30 May 2025

CVE-2022-30332: Talend Administration Center · Observable Discrepancy

Source CVE Database V5

Not known to be exploited · CVSS 5.3 Medium.

Data as of 26 Oct 2026, 11:07 UTC

CVSS 3.1 base score

5.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.8% chance of exploitation in 30 days – higher than 58% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N

Attack Complexity: Low
Attack Vector: Network
Availability: None
Confidentiality: Low
Integrity: None
Privileges Required: None
Scope: Unchanged
User Interaction: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Availability: None: There is no impact to availability within the impacted component.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Jan 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate CVE-2022-30332, European organizations should implement the following specific measures: 1) Apply the official TAC-15950 update or any subsequent patches from Talend that address this vulnerability as soon as they become available. 2) If patches are not immediately available, modify the 'Forgot Password' feature to standardize error messages regardless of whether the email exists in the system, thereby preventing account enumeration. 3) Implement rate limiting and CAPTCHA mechanisms on password reset endpoints to reduce the feasibility of automated enumeration attacks. 4) Monitor logs for repeated password reset attempts from the same IP addresses or suspicious patterns indicative of enumeration attempts. 5) Educate users about phishing risks and encourage strong, unique passwords combined with multi-factor authentication (MFA) to reduce the impact of potential credential compromise. 6) Conduct regular security assessments and penetration tests focusing on authentication and account recovery workflows to identify similar information leakage issues. These targeted actions go beyond generic advice by focusing on the specific vulnerability vector and its exploitation method.

Description

In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests.

Impact

For European organizations using Talend Administration Center, this vulnerability poses a risk primarily to user privacy and organizational security posture. By enabling attackers to enumerate valid user accounts, it increases the likelihood of targeted attacks such as credential stuffing, phishing campaigns, or social engineering attacks that leverage confirmed user identities. This can lead to unauthorized access if combined with other vulnerabilities or weak password policies. While the vulnerability itself does not allow direct system compromise or data manipulation, the information gained can be a stepping stone for more severe attacks. Organizations handling sensitive data or operating in regulated industries (e.g., finance, healthcare, or critical infrastructure) may face compliance risks if user account information is exposed or exploited. Additionally, the presence of this vulnerability could damage trust in the organization’s security practices if exploited. Given the medium severity and ease of exploitation, European entities should prioritize remediation to reduce the attack surface and protect user confidentiality.

CWE-203Observable Discrepancy (opens in a new tab)
Base weakness
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended).
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
Attack patterns
Black Box Reverse Engineering (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 8 Jul 2025, 15:41 UTC

WeaknessesCWE-203

Technical details

References

Community reviews

Related threats