Vulnerability · Published Jan 13, 2022 · Assigned by Mend
CVE-2022-22113DayByDay CRM - Insufficient Session Expiration after Password Change
High 8.8
In plain English
A high-severity security flaw in DaybydayCRM from Bottelet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 35.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bottelet | DaybydayCRM | 2.2.0 – before unspecified |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H