CVE-2022-22111: DayByDay CRM - Missing Authorization when Changing Password
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22111?
CVE-2022-22111 is considered a critical vulnerability due to its potential for unauthorized password changes and system compromise.
How do I fix CVE-2022-22111?
To mitigate CVE-2022-22111, update to a patched version of DayByDay CRM where authorization checks for password changes are properly enforced.
Who is affected by CVE-2022-22111?
CVE-2022-22111 affects all users of DayByDay CRM version 2.2.0 who have update user permissions enabled.
What impact does CVE-2022-22111 have on DayByDay CRM?
CVE-2022-22111 allows any user with update permissions to change any other user's password, including that of the administrator.
Is there a known exploit for CVE-2022-22111?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2022-22111, but its nature poses significant security risks.