CVE-2022-25770 — Insufficient authentication in upgrade flow

CVE-2022-25770

Insufficient authentication in upgrade flow PUBLISHED

Description (CNA)

Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.

Affected (CNA)

Vendor / product	Versions
Mautic / Mautic	affected >= 1.0.0-beta3 before < 4.4.13; affected >= 5.0.0 before < 5.1.1.

CWE

CWE-306

References

https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.