CVE-2022-25770 HIGH

CVE-2022-25770: Insufficient authentication in upgrade flow

Vendor Mautic
Product Mautic
Weakness CWE-306 · Missing auth
Published September 18, 2024
Last update September 19, 2024
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

What the vulnerability does

01Description

Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.

Key dates

02Disclosure timeline

September 18, 2024 CVE published
September 19, 2024 Record updated