CVE-2022-25770

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mautic allows you to update the application via an upgrade script.

The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.

This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-257726.1A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executableCVE-2022-257735.4This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * CVE-2022-257745.4Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. UserCVE-2022-257757.2Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user coCVE-2022-257766.5Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accesCVE-2022-257776.5Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application dCVE-2022-257788.8Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in CVE-2022-257794.3Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries in audit log. This iCVE-2022-25789.8A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unCVE-2022-257804.3Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.CVE-2022-257816.1Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged CVE-2022-257825.4Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privi
CVE-2022-25770: High severity, CVSS 7.5 | Vulnix