« Volver al listado

CVE-2022-25773

Estado: AnalizadaMedia (5.4)—

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.

Detalles técnicos trazas, registros y código del informe original
  *  Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Acquia — Mautic

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-25773",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-25773",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-26T14:54:09.781777Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@mautic.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@mautic.org",
      "affectedData": [
        {
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "product": "mautic/core",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.2.3",
              "versionType": "semver"
            }
          ],
          "packageName": "mautic/core",
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-26T13:15:32.550",
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mautic.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@mautic.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.\n\n  *  Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory."
    },
    {
      "lang": "es",
      "value": "Este aviso aborda una vulnerabilidad de ubicación de archivos que podría permitir que se carguen activos en directorios no deseados en el servidor. * Limitación incorrecta de una ruta a un directorio restringido: existe una vulnerabilidad en la funcionalidad de carga de activos que permite a los usuarios cargar archivos en directorios fuera del directorio temporal previsto."
    }
  ],
  "lastModified": "2026-06-17T04:34:15.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CB561B0-7B21-4E13-8242-713E16CC488F",
              "versionEndExcluding": "5.2.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mautic.org"
}