What is CVE-2022-22111?

CVE-2022-22111 is a high-severity vulnerability in Bottelet Daybydaycrm, classified under Missing Authorization. CVSS score: 8.8/10. Published 2022-01-05.

How severe is CVE-2022-22111?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Bottelet Daybydaycrm

CVE-2022-22111

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows…

Vulnerability class: Broken Access Control

EPSS: 0.010 (58.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Bottelet Daybydaycrm — versions 2.2.0
Bottelet Flarepoint — versions 2.2.0
Daybydaycrm Daybyday_crm — versions 2.2.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

vulnerabilitylab@mend.io (Patch, Third Party Advisory, x_refsource_MISC)
vulnerabilitylab@mend.io (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-22111?: CVE-2022-22111 is a high-severity vulnerability in Bottelet Daybydaycrm, classified under Missing Authorization. CVSS score: 8.8/10. Published 2022-01-05.
How severe is CVE-2022-22111?: High severity. CVSS v3 base score is 8.8 out of 10.