Vulnerability · Published Sep 18, 2024 · Assigned by Mautic
CVE-2022-25776Sensitive Data Exposure due to inadequate user permission settings
High 8.3
In plain English
A high-severity incorrect default permissions in Mautic from Mautic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.4%top 65.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | 4.4.12 | GHSA-qjx3-2g35-6hv8 |
| Packagist | mautic/core | 5.0.4 | GHSA-qjx3-2g35-6hv8 |
Affected products (as reported)
Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H