CVE-2022-22111 DayByDay CRM - Missing Authorization when Changing Password

2022-01-0515:05:22

CWE-862

Mend

www.cve.org

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.0%

JSON

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.

CNA Affected

[
  {
    "product": "DaybydayCRM",
    "vendor": "Bottelet",
    "versions": [
      {
        "status": "affected",
        "version": "2.2.0"
      }
    ]
  },
  {
    "product": "flarepoint",
    "vendor": "Bottelet",
    "versions": [
      {
        "status": "affected",
        "version": "2.2.0"
      }
    ]
  }
]