CVE-2022-25775 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.

Reserved 2022-02-22 | Published 2024-09-18 | Updated 2024-09-18 | Assigner Mautic

MEDIUM: 6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

unaffected

>= 2.14.1 before < 4.4.12

affected

> 5.0.0 before < 5.0.4

affected

Credits

a-solovev reporter

Lenon Leite remediation developer

John Linhart remediation developer

John Linhart remediation reviewer

Akivarsha Saha remediation reviewer

References

github.com/...mautic/security/advisories/GHSA-jj6w-2cqg-7p94

cve.org (CVE-2022-25775)

nvd.nist.gov (CVE-2022-25775)

Download JSON

https://cve.threatint.com/CVE/CVE-2022-25775

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.