CVE-2022-22107 (published 2022-01-05T15:15Z)

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/Bottelet/DaybydayCRM
commit_details: repo_url: https://github.com/Bottelet/DaybydayCRM
author: Casper Bottelet
author_date: 2021-06-25 20:03:43+02:00
msg: password change requires 6 on update, and only allowed users can see calendar
repository: repo_url: https://github.com/Bottelet/DaybydayCRM
repo_name: Bottelet/DaybydayCRM
description: DaybydayCRM an open-source CRM, to help you keep track of your daily workflow.
repo_language: PHP
owner: Bottelet
file_changes: filename: AppointmentsController.php
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,10 @@ class AppointmentsController extends Controller
 {
     public function calendar()
     {
+        if (!auth()->user()->can("calendar-view")) {
+            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
+            return redirect()->back();
+        }
         return view('appointments.calendar');
     }
 
@@ -38,7 +42,6 @@ class AppointmentsController extends Controller
 
     public function store(CreateAppointmentCalendarRequest $request)
     {
- 
         $client_id = null;
         $user = User::where('external_id', $request->user)->first();
 
@@ -86,7 +89,7 @@ class AppointmentsController extends Controller
 
     public function destroy(Appointment $appointment)
     {
-        if (!auth()->user()->can("appointment-create")) {
+        if (!auth()->user()->can("appointment-delete")) {
             return response("Access denied", 403);
         }
 

programming_language: PHP
filename: StoreUserRequest.php
change_type: ModificationType.MODIFY
diff: @@ -29,8 +29,8 @@ class StoreUserRequest extends FormRequest
             'address' => '',
             'primary_number' => 'numeric',
             'secondary_number' => 'numeric',
-            'password' => 'required|min:5|confirmed',
-            'password_confirmation' => 'required|min:5',
+            'password' => 'required|min:6|confirmed',
+            'password_confirmation' => 'required|min:6',
             'image_path' => '',
             'roles' => 'required',
             'departments' => 'required'

programming_language: PHP
filename: UpdateUserRequest.php
change_type: ModificationType.MODIFY
diff: @@ -29,8 +29,8 @@ class UpdateUserRequest extends FormRequest
             'address' => '',
             'primary_number' => 'numeric',
             'secondary_number' => 'numeric',
-            'password' => 'sometimes',
-            'password_confirmation' => 'sometimes',
+            'password' => 'sometimes|min:6|confirmed',
+            'password_confirmation' => 'sometimes|min:6',
             'image_path' => '',
             'departments' => 'required'
         ];

programming_language: PHP