« Volver al listado

CVE-2022-25770

Estado: AnalizadaAlta (7.5)—

Mautic allows you to update the application via an upgrade script.

The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.

This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Acquia — Mautic

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-25770",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-25770",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-19T14:47:02.190322Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@mautic.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.4
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@mautic.org",
      "affectedData": [
        {
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "product": "Mautic",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.0.0-beta3",
              "lessThan": "< 4.4.13",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0",
              "lessThan": "< 5.1.1.",
              "versionType": "semver"
            }
          ],
          "packageName": "mautic/core-lib",
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-18T22:15:03.827",
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mautic.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@mautic.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable."
    },
    {
      "lang": "es",
      "value": "Mautic permite actualizar la aplicación mediante un script de actualización. La lógica de actualización no está protegida correctamente, lo que puede generar una situación vulnerable. Esta vulnerabilidad se ve mitigada por el hecho de que Mautic debe instalarse de una determinada manera para que sea vulnerable."
    }
  ],
  "lastModified": "2026-06-17T04:34:14.970",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "496E995E-E33A-4481-83A6-38172DA11763",
              "versionEndExcluding": "4.4.13",
              "versionStartIncluding": "1.0.1"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC060988-1D0C-4CB2-A052-A0BCCD236381",
              "versionEndExcluding": "5.1.1",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99718D48-5C19-41C5-84E1-52E95F012830"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C1C106B-1B3D-427D-8147-5527E610F569"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E35B0F0-9BF1-45FA-8954-B8BFB7389C4D"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "213A9276-B9D1-4B4D-BBE9-FC42B6D63DE1"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F366E4D8-1515-4E5F-8551-4C8D9E00D0D9"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4234B41-F219-45B7-83A1-8F0F652F2A8B"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA028F70-6020-47D6-BEC0-6FC0C7E18420"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mautic.org"
}