CVE-2022-22107
Summary
| CVE | CVE-2022-22107 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-01-05 15:15:00 UTC |
| Updated | 2022-01-08 02:49:00 UTC |
| Description | In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all. |
Risk And Classification
Problem Types: CWE-862
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Daybydaycrm | Daybyday Crm | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| password change requires 6 on update, and only allowed users can see … · Bottelet/DaybydayCRM@a0392f4 · GitHub | CONFIRM | github.com | |
| CVE-2022-22107 | WhiteSource Vulnerability Database | MISC | www.whitesourcesoftware.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: WhiteSource Vulnerability Research Team (WVR)
There are currently no legacy QID mappings associated with this CVE.