CVE-2022-22107

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Bottelet	DaybydayCRM	>= 2.0.0, < unspecified; >= unspecified, <= 2.2.0
Bottelet	flarepoint	>= 2.0.0, < unspecified; >= unspecified, <= 2.2.0

References

https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661bPatch, Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22107Third Party Advisory
https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661bPatch, Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22107Third Party Advisory

Timeline

Published: Jan 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-221084.3In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (e CVE-2022-221095.4In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users CVE-2022-22116.5A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys()CVE-2022-221107.5In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to u CVE-2022-221118.8In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permissio CVE-2022-221125.4In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged CVE-2022-221138.8In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed b CVE-2022-221149.6In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not s CVE-2022-221159.0In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is CVE-2022-221165.4In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in m CVE-2022-221175.4In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which lea CVE-2022-22128.8A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown functi