CVE-2022-22107: DayByDay CRM - Missing Authorization when Viewing Appointments
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22107?
CVE-2022-22107 is considered a moderate severity vulnerability due to the risk of unauthorized data access.
How do I fix CVE-2022-22107?
To fix CVE-2022-22107, upgrade Daybyday CRM to version 2.2.1 or later.
What are the consequences of CVE-2022-22107?
An attacker with a low-privilege account can view all users' appointments, posing a risk to privacy and confidentiality.
Who is affected by CVE-2022-22107?
Users of Daybyday CRM versions 2.0.0 through 2.2.0 are affected by CVE-2022-22107.
How can I verify if my system is vulnerable to CVE-2022-22107?
You can verify vulnerability to CVE-2022-22107 by checking the version of your Daybyday CRM installation.