CVE-2022-25776
Last modified
CVE-2022-25776 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Acquia | Mautic | >= 1.0.2, < 4.4.12 |
| Acquia | Mautic | >= 5.0.0, < 5.0.4 |
References
- https://github.com/mautic/mautic/security/advisories/GHSA-qjx3-2g35-6hv8Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-25776?
How severe is CVE-2022-25776?
How do I fix CVE-2022-25776?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2577A vulnerability classified as critical was found in SourceCo…8.8
- CVE-2022-25770Mautic allows you to update the application via an upgrade s…7.5
- CVE-2022-25772A cross-site scripting (XSS) vulnerability in the web tracki…6.1
- CVE-2022-25773This advisory addresses a file placement vulnerability that …5.4
- CVE-2022-25774Prior to the patched version, logged in users of Mautic are …5.4
- CVE-2022-25775Prior to the patched version, logged in users of Mautic are …7.2
- CVE-2022-25777Prior to the patched version, an authenticated user of Mauti…6.5
- CVE-2022-25778Cross-Site Request Forgery (CSRF) vulnerability in Web UI of…8.8
- CVE-2022-25779Logging of Excessive Data vulnerability in audit log of Seco…4.3
- CVE-2022-2578A vulnerability, which was classified as critical, has been …9.8
- CVE-2022-25780Information Exposure vulnerability in web UI of Secomea Gate…4.3
- CVE-2022-25781Cross-site Scripting (XSS) vulnerability in Web UI of Secome…6.1
Are you affected by CVE-2022-25776?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST