CVE-2022-25770CWE-306
Insufficient authentication in upgrade flow
High · published September 18, 2024
What it is
Mautic allows you to update the application via an upgrade script.
The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.
This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
The record
Technical detail
- CVSS v3.1
- 7.8 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00277 · 19.1th percentile
- Weakness
- CWE-306 · Missing Authentication for Critical Function
- Published
- 2024-09-18T21:26Z
EPSS history
Timeline