CVE-2022-25770
Last modified
CVE-2022-25770 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Acquia | Mautic | >= 1.0.1, < 4.4.13 |
| Acquia | Mautic | >= 5.0.0, < 5.1.1 |
| Acquia | Mautic | 1.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-25770?
How severe is CVE-2022-25770?
How do I fix CVE-2022-25770?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25765The package pdfkit from 0.0.0 are vulnerable to Command Inje…9.8
- CVE-2022-25766The package ungit before 1.5.20 are vulnerable to Remote Cod…8.8
- CVE-2022-25767All versions of package com.bstek.ureport:ureport2-console a…9.8
- CVE-2022-25768The logic in place to facilitate the update process via the …6.5
- CVE-2022-25769ImpactThe default .htaccess file has some restrictions in th…9.1
- CVE-2022-2577A vulnerability classified as critical was found in SourceCo…8.8
- CVE-2022-25772A cross-site scripting (XSS) vulnerability in the web tracki…6.1
- CVE-2022-25773This advisory addresses a file placement vulnerability that …5.4
- CVE-2022-25774Prior to the patched version, logged in users of Mautic are …5.4
- CVE-2022-25775Prior to the patched version, logged in users of Mautic are …7.2
- CVE-2022-25776Prior to the patched version, logged in users of Mautic are …6.5
- CVE-2022-25777Prior to the patched version, an authenticated user of Mauti…6.5
Are you affected by CVE-2022-25770?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST