GHSA-44gv-fgcj-w546

ghsaUSosv

Missing Authorization in DayByDay CRM

view advisory published 2022-01-08Licence: CC-BY-4.0

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-22107US	medium4.3OT elevated	0.68% (52nd)	—	2022-01-05
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appoint…

references

External citations — patches, advisories, analysis.

https://github.com/Bottelet/DaybydayCRMPACKAGE
https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661bWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-22107ADVISORY
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22107WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan