CVE-2022-25770
CVE-2022-25770
7.8
HighPublished:
Last updated:
Source:security@mautic.org
Analyzed
Weakness (CWE)
CVSS Vector
v3.1- Attack Vector
- Local
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Description
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
References
security@mautic.org
https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc