CVE-2022-25768

CVSS V2 None CVSS V3 None

Description

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Overview

CVE ID
CVE-2022-25768

Assigner
Mautic

Vulnerability Status
PUBLISHED

Published Version
2024-09-18T20:55:53.187Z

Last Modified Date
2024-09-18T20:55:53.187Z

Weakness Enumerations

CWE	URL
CWE-287	http://cwe.mitre.org/data/definitions/287.html

References

Reference URL	Reference Tags
https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2022-25768
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25768

History

Created	Old Value	New Value	Data Type	Notes
2024-10-06 03:17:56				Added to TrackCVE