CVE-2022-22110: DayByDay CRM - Weak Password Requirements in Update User
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22110?
CVE-2022-22110 is classified as a medium severity vulnerability due to its potential for exploitation via weak password enforcement.
How do I fix CVE-2022-22110?
To fix CVE-2022-22110, update Daybyday CRM to version 2.2.1 or later, which implements stronger password requirements.
What versions of Daybyday CRM are affected by CVE-2022-22110?
CVE-2022-22110 affects Daybyday CRM versions from 1.1 through 2.2.0.
What kind of attacks can CVE-2022-22110 enable?
CVE-2022-22110 can enable brute-force attacks due to the enforcement of weak password requirements.
Who is at risk from CVE-2022-22110?
Users of Daybyday CRM with the ability to update their passwords are at risk from CVE-2022-22110 if they choose weak passwords.