CVE-2022-22111highCWE-862

CVE-2022-22111: falha de alta gravidade em Bottelet DaybydayCRM

DayByDay CRM - Missing Authorization when Changing Password

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar DaybydayCRM+ Monitorar flarepoint

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 1.0%
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Bottelet · DaybydayCRMBottelet · flarepoint
CVEs relacionadas — Bottelet DaybydayCRM

No mesmo produto, das mais perigosas para as menos.

CVE-2022-22110HIGHDayByDay CRM - Weak Password Requirements in Update UserEPSS 1.2%CVE-2022-22113HIGHDayByDay CRM - Insufficient Session Expiration after Password ChangeEPSS 1.1%CVE-2022-22108MEDIUMDayByDay CRM - Missing Authorization when Viewing AbsencesEPSS 0.7%CVE-2022-22107MEDIUMDayByDay CRM - Missing Authorization when Viewing AppointmentsEPSS 0.7%CVE-2022-22112MEDIUMDayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)EPSS 0.6%CVE-2022-22109MEDIUMDayByDay CRM - Stored Cross-Site Scripting (XSS) in Task TitleEPSS 0.5%