CVE-2022-47003

CriticalCVSS 9.8/10Last modified Jul 9, 2026

Description

A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://hoyahaxa.blogspot.com/2023/01/preliminary-security-advisory.htmlPatch, Third Party Advisory
https://hoyahaxa.blogspot.com/2023/03/authentication-bypass-mura-masa.html
https://www.masacms.com/Not Applicable
https://www.murasoftware.com/mura-cms/Product
https://hoyahaxa.blogspot.com/2023/01/preliminary-security-advisory.htmlPatch, Third Party Advisory
https://hoyahaxa.blogspot.com/2023/03/authentication-bypass-mura-masa.html
https://www.masacms.com/Not Applicable
https://www.murasoftware.com/mura-cms/Product

Timeline

Published: Feb 1, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-470075.5An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service d CVE-2022-470085.5An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial CVE-2022-47018.8The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX act CVE-2022-470105.5An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due t CVE-2022-470115.5An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of servi CVE-2022-470127.5Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21.CVE-2022-470156.5MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to CVE-2022-47026.5The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX actio CVE-2022-470217.8A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows at CVE-2022-470224.7An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset CVE-2022-470247.8A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows att CVE-2022-470279.8Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionar