CVE-2022-22111
Assigner: Mend
Published: 2022-01-05T15:05:22
State: PUBLISHED
affected: product: DaybydayCRM
vendor: Bottelet
versions: status: affected
version: 2.2.0
product: flarepoint
vendor: Bottelet
versions: status: affected
version: 2.2.0
credits: value: WhiteSource Vulnerability Research Team (WVR)
descriptions: value: In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
solutions: value: Update to 2.2.1
source: advisory: https://www.whitesourcesoftware.com/vulnerability-database/
discovery: UNKNOWN
title: DayByDay CRM - Missing Authorization when Changing Password
x_generator: engine: Vulnogram 0.0.9