CVE-2022-25776 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.

Reserved 2022-02-22 | Published 2024-09-18 | Updated 2024-09-18 | Assigner Mautic

HIGH: 8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Problem types

CWE-276 Incorrect Default Permissions

Product status

Default status

unaffected

>= 1.0.2 before < 4.4.12

affected

>5.0.0 before < 5.0.4

affected

Credits

infosec-it-init reporter

Lenon Leite remediation developer

Avikarsha Saha remediation reviewer

John Linhart remediation reviewer

References

github.com/...mautic/security/advisories/GHSA-qjx3-2g35-6hv8

cve.org (CVE-2022-25776)

nvd.nist.gov (CVE-2022-25776)

Download JSON

https://cve.threatint.com/CVE/CVE-2022-25776

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.