GitHub Advisoryadvisory · Packagist

GHSA-w6rp-4vj7-v2m8 Missing Authorization in DayByDay CRM

HIGH Published 2022-01-08 Modified 2022-01-10 Official page ↗
Aliases
CVE-2022-22111
Ecosystem
Packagist
Packages
bottelet/flarepoint
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862
Reviewed
2022-01-07

Affected packages

• Packagist bottelet/flarepoint: < 2.2.1 → fixed in 2.2.1

Description

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.

Related

Alias · CVE (1)

  • CVE-2022-22111 In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References