PT-2022-21201 · Squiz · Squiz Matrix Cms

Published 2022-09-06 · Updated 2024-08-03 · CVE-2022-32277

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Squiz Matrix CMS version 6.20

Description The issue is caused by a failure to correctly validate authorization when submitting a request to change a user's contact details, leading to an Insecure Direct Object Reference. This allows unauthorized access to user data. The vulnerability is disputed by both the vendor and the original discoverer as it is considered a site-specific finding rather than a product-wide issue.

Recommendations For Squiz Matrix CMS version 6.20, consider restricting access to the user contact details modification feature until a patch or official guidance is available from the vendor. As a temporary workaround, review and strengthen authorization validation for all requests related to user data modification to prevent unauthorized changes.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-32277

Affected Products

Squiz Matrix Cms

References · 7

• https://osv.dev/vulnerability/CVE-2022-32277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32277 · Security Note
• https://t.me/cvenotify/42377 · Telegram Post
• https://trustwave.com/en-us/resources/blogs/spiderlabs-blog · Note
• https://t.me/cvenotify/88739 · Telegram Post
• https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor · Note
• https://t.me/cibsecurity/49380 · Telegram Post