CVE-2022-25776: Sensitive Data Exposure due to inadequate user permission settings
First published: Fri Apr 12 2024(Updated: )
### Impact Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names. ### Patches Update to 4.4.12 and 5.0.4 ### Workarounds No ### References https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure
Credit: security@mautic.org security@mautic.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/mautic/core | >=5.0.0-alpha<5.0.4 | 5.0.4 |
| composer/mautic/core | >=1.0.2<4.4.12 | 4.4.12 |
| Mautic | >=1.0.2<4.4.12 | |
| Mautic | >=5.0.0<5.0.4 |
Remedy
Update to 4.4.12 or 5.0.4 or later.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/mautic/mautic/security/advisories/GHSA-qjx3-2g35-6hv8
- https://github.com/mautic/mautic/commit/22bdd0796ca6e1e985708b89ad5c07147630fecd
- https://github.com/mautic/mautic/commit/2cc4af975fe01c264d439acc1451c936e7114644
- https://github.com/advisories/GHSA-qjx3-2g35-6hv8 (Advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2022-25776
Frequently Asked Questions
What is the severity of CVE-2022-25776?
The severity of CVE-2022-25776 is considered high due to its potential impact on sensitive data access.
How do I fix CVE-2022-25776?
To fix CVE-2022-25776, you should update Mautic to version 5.0.4 or 4.4.12.
Who is affected by CVE-2022-25776?
Logged in users of Mautic versions prior to 4.4.12 and 5.0.4 are affected by CVE-2022-25776.
What kind of data can be accessed due to CVE-2022-25776?
Due to CVE-2022-25776, users may gain unauthorized access to sensitive information including names, company names, and stage names.
Is there a patch available for CVE-2022-25776?
Yes, patches for CVE-2022-25776 have been released in versions 4.4.12 and 5.0.4 of Mautic.
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-qjx3-2g35-6hv8
- alias/CVE-2022-25776
- agent/software-canonical-lookup
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/composer
- vendor/acquia
- canonical/mautic
- version/mautic/1.0.2
- version/mautic/5.0.0