Logged-in users at risk of SQL injection vulnerability in Mautic Reports bundle
CVE-2022-25775
7.2HIGH
Key Information
- Vendor
- Mautic
- Status
- Mautic
- Vendor
- CVE Published:
- 18 September 2024
Summary
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
Affected Version(s)
Mautic < 2.14.1
Mautic < 5.0.0
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published.
Vulnerability Reserved.
Collectors
NVD DatabaseMitre Database
Credit
a-solovev
Lenon Leite
John Linhart
John Linhart
Akivarsha Saha