CVE-2022-25775
Last modified
CVE-2022-25775 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Acquia | Mautic | >= 2.14.1, < 4.4.12 |
| Acquia | Mautic | >= 5.0.0, < 5.0.4 |
References
- https://github.com/mautic/mautic/security/advisories/GHSA-jj6w-2cqg-7p94Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-25775?
How severe is CVE-2022-25775?
How do I fix CVE-2022-25775?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25769ImpactThe default .htaccess file has some restrictions in th…9.1
- CVE-2022-2577A vulnerability classified as critical was found in SourceCo…8.8
- CVE-2022-25770Mautic allows you to update the application via an upgrade s…7.5
- CVE-2022-25772A cross-site scripting (XSS) vulnerability in the web tracki…6.1
- CVE-2022-25773This advisory addresses a file placement vulnerability that …5.4
- CVE-2022-25774Prior to the patched version, logged in users of Mautic are …5.4
- CVE-2022-25776Prior to the patched version, logged in users of Mautic are …6.5
- CVE-2022-25777Prior to the patched version, an authenticated user of Mauti…6.5
- CVE-2022-25778Cross-Site Request Forgery (CSRF) vulnerability in Web UI of…8.8
- CVE-2022-25779Logging of Excessive Data vulnerability in audit log of Seco…4.3
- CVE-2022-2578A vulnerability, which was classified as critical, has been …9.8
- CVE-2022-25780Information Exposure vulnerability in web UI of Secomea Gate…4.3
Are you affected by CVE-2022-25775?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST