CVE-2022-25769: Improper regex in htaccess file
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.
This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25769?
CVE-2022-25769 is considered a medium severity vulnerability due to its access restrictions not being correctly enforced.
How do I fix CVE-2022-25769?
To fix CVE-2022-25769, update Mautic to version 4.2.0 or later.
Which versions of Mautic are affected by CVE-2022-25769?
CVE-2022-25769 affects Mautic versions prior to 4.0.0 and between 4.0.0 and 4.2.0.
What happens if I don’t address CVE-2022-25769?
If not addressed, CVE-2022-25769 could allow unauthorized execution of PHP files, leading to potential security breaches.
Is CVE-2022-25769 related to specific file access issues?
Yes, CVE-2022-25769 is related to incorrect regex in the .htaccess file that fails to restrict access properly to certain PHP files.