CVE-2022-25770: Insufficient authentication in upgrade flow
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qf6m-6m4g-rmrc. This link is maintained to preserve external references.
Original Description Mautic allows you to update the application via an upgrade script.
The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.
This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
Other sources
Impact
Mautic allows you to update the application via an upgrade script.
The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.
This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable
Patches
Please upgrade to 4.4.1 or 5.1.1 or later.
Workarounds None.
For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
— GitHub
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25770?
CVE-2022-25770 is considered a moderate severity vulnerability due to the specific conditions required for exploitation.
How do I fix CVE-2022-25770?
To mitigate CVE-2022-25770, upgrade Mautic to version 5.1.1 or 4.4.13.
What is the impact of CVE-2022-25770?
CVE-2022-25770 may allow unauthorized upgrades leading to potential application vulnerabilities if installed improperly.
Which versions of Mautic are affected by CVE-2022-25770?
Versions of Mautic from 5.0.0 up to 5.1.1 and from 1.0.0-beta3 up to 4.4.13 are affected by CVE-2022-25770.
Is CVE-2022-25770 easy to exploit?
Exploitation of CVE-2022-25770 requires specific system configurations, making it less common.