CVE-2022-25775: Mautic SQL Injection in dynamic Reports
Impact Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle.
The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
Patches Update to 4.4.12 or 5.0.4
Workarounds No
References - https://owasp.org/www-community/attacks/SQLInjection - https://owasp.org/www-community/attacks/BlindSQLInjection
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 5.0.4 - Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 4.4.12 - Upgrade
Upgrade
Mauticto a version that resolves this vulnerability.Fixed in 4.4.12 - Upgrade
Upgrade
Mauticto a version that resolves this vulnerability.Fixed in 5.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25775?
CVE-2022-25775 has a medium severity rating due to its potential impact on sensitive data and system integrity.
How do I fix CVE-2022-25775?
To fix CVE-2022-25775, update Mautic to version 5.0.4 or 4.4.12 or later.
What type of vulnerability is CVE-2022-25775?
CVE-2022-25775 is an SQL injection vulnerability affecting the Reports bundle in Mautic.
Who is affected by CVE-2022-25775?
Users of Mautic versions prior to 5.0.4 and 4.4.12 are affected by CVE-2022-25775.
What could an attacker do with CVE-2022-25775?
An attacker exploiting CVE-2022-25775 could potentially retrieve and alter sensitive data and manipulate file systems.