MauticVULNRICHMENT:CVE-2022-25776CVE-2022-25776 Sensitive Data Exposure due to inadequate user permission settings
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
AI Score
Confidence
Low
EPSS
Percentile
21.0%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial
Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing.
Users could potentially access sensitive data such as names and surnames, company names and stage names.
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
AI Score
Confidence
Low
EPSS
Percentile
21.0%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial