Auth bypass in Acquia Mautic
CVE-2022-25770
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (18.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Acquia Mautic — versions 1.0.0
- Mautic — versions >= 1.0.0-beta3, >= 5.0.0
Weakness classification (CWE)
References
- github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-25770?
- CVE-2022-25770 is a high-severity vulnerability in Acquia Mautic, classified under Missing Authentication for Critical Function. CVSS score: 7.8/10. Published 2024-09-18.
- How severe is CVE-2022-25770?
- High severity. CVSS v3 base score is 7.8 out of 10.