Vulnerability · Published Sep 18, 2024 · Assigned by Mautic
CVE-2022-25768Improper Access Control in UI upgrade process
High 7.0
In plain English
A high-severity improper authentication in Mautic from Mautic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | 4.4.13 | GHSA-x3jx-5w6m-q2fc |
| Packagist | mautic/core | 5.1.1 | GHSA-x3jx-5w6m-q2fc |
| Packagist | mautic/core-lib | 4.4.13 | GHSA-x3jx-5w6m-q2fc |
| Packagist | mautic/core-lib | 5.1.1 | GHSA-x3jx-5w6m-q2fc |
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H