Products
Mautic
Source
security@mautic.org
Tags
CVE-2022-25770 details
Published : Sept. 18, 2024, 10:15 p.m.
Last Modified : Sept. 18, 2024, 10:15 p.m.
Last Modified : Sept. 18, 2024, 10:15 p.m.
Description
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.8 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
CVSS Data
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
7.8
Exploitability Score
1.4
Impact Score
5.8
Base Severity
HIGH
Vector String : CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
References
| URL | Source |
|---|---|
| https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc | security@mautic.org |
This website uses the NVD API, but is not approved or certified by it.