CVE-2022-22108mediumCWE-862

CVE-2022-22108: medium-severity vulnerability in Bottelet DaybydayCRM

DayByDay CRM - Missing Authorization when Viewing Absences

Published · Updated

Follow this CVE+ Monitor DaybydayCRM+ Monitor flarepoint

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.7%
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Bottelet · DaybydayCRMBottelet · flarepoint
Related CVEs — Bottelet DaybydayCRM

In the same product, most dangerous first.

CVE-2022-22110HIGHDayByDay CRM - Weak Password Requirements in Update UserEPSS 1.2%CVE-2022-22113HIGHDayByDay CRM - Insufficient Session Expiration after Password ChangeEPSS 1.1%CVE-2022-22111HIGHDayByDay CRM - Missing Authorization when Changing PasswordEPSS 1.0%CVE-2022-22107MEDIUMDayByDay CRM - Missing Authorization when Viewing AppointmentsEPSS 0.7%CVE-2022-22112MEDIUMDayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)EPSS 0.6%CVE-2022-22109MEDIUMDayByDay CRM - Stored Cross-Site Scripting (XSS) in Task TitleEPSS 0.5%