CVE-2022-22108: DayByDay CRM - Missing Authorization when Viewing Absences
Published Jan 5, 2022
·Updated
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
Affected Software
1 affected component
Daybydaycrm Daybyday Crm>=2.0.0<=2.2.0
Remediation
Information
Update to 2.2.1
Event History
Jan 5, 2022
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-22108?
CVE-2022-22108 has a medium severity rating due to its impact on data confidentiality.
2
How do I fix CVE-2022-22108?
To fix CVE-2022-22108, upgrade Daybyday CRM to version 2.2.1 or later.
3
Who is affected by CVE-2022-22108?
CVE-2022-22108 affects users of Daybyday CRM versions 2.0.0 through 2.2.0.
4
What type of vulnerability is CVE-2022-22108?
CVE-2022-22108 is classified as a Missing Authorization vulnerability.
5
What could an attacker do by exploiting CVE-2022-22108?
An attacker exploiting CVE-2022-22108 can view the absence records of all users in the system.