CVE-2022-25768

Improper Access Control in UI upgrade process

State: Published
Severity: 7.0 High
Published: Sep 18, 2024
Updated: Sep 19, 2024
Reserved: Feb 22, 2022

Description

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H	Mautic

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
MauticMautic	>= 1.1.3 to before < 4.4.13Affected >= 5.0.0 to before < 5.1.1Affected

References

https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.