CVE-2022-22108
MEDIUM4.3EPSS 0.15%Missing Authorization in DayByDay CRM
發布日:2022/1/8修改日:2024/2/19
描述
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
受影響套件(1)
- Packagist/bottelet/flarepoint>= 2.0.0, < 2.2.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |