PT-2022-15243 · Unknown · Daybyday Crm

Published 2022-01-05 · Updated 2022-01-08 · CVE-2022-22107

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Daybyday CRM versions 2.0.0 through 2.2.0

Description The issue allows an attacker with the lowest privileges account, specifically an employee type user, to view the appointments of all users in the system, including administrators. This is a problem because such a user is not authorized to view the calendar at all.

Recommendations For Daybyday CRM versions 2.0.0 through 2.2.0, consider restricting access to the calendar feature for employee type users until a patch is available. As a temporary workaround, limit the privileges of employee type users to prevent them from viewing appointments of other users, including administrators. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-22107

GHSA-44GV-FGCJ-W546

Affected Products

Daybyday Crm

References · 7

• https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661b · Patch
• https://osv.dev/vulnerability/GHSA-44gv-fgcj-w546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22107 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22107 · Vendor Advisory
• https://github.com/Bottelet/DaybydayCRM · Note
• https://whitesourcesoftware.com/vulnerability-database/CVE-2022-22107 · Note
• https://t.me/cibsecurity/34988 · Telegram Post