CVE-2022-25775

MEDIUM

Mautic 2.14.1-4.4.11 - Authenticated SQL Injection in Reports Bundle

Title source: llm
STIX 2.1

Description

Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.

References (1)

Core 1

Scores

CVSS v3 6.6
EPSS 0.0059
EPSS Percentile 44.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (2)
acquia/mautic 2.14.1 - 4.4.12
mautic/core 2.14.1 - 4.4.12Packagist
Published Sep 18, 2024
Tracked Since Feb 18, 2026