PT-2025-4644 · Unknown · My Tickets

Mika · Published 2025-01-21 · Updated 2025-01-21 · CVE-2025-22717

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions My Tickets versions 2.0.9 and earlier

Description The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists (ACLs). This means that certain functions or areas of the software are not correctly restricted, potentially allowing unauthorized access.

Recommendations For versions 2.0.9 and earlier, update to a version later than 2.0.9 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the software to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-22717

Affected Products

My Tickets

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-22717 · Security Note
• https://t.me/cvedetector/15967 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/my-tickets/vulnerability/wordpress-my-tickets-plugin-2-0-9-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1881746705726497077 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/my-tickets/vulnerability/wordpress-my-tickets-plugin-2-0-9-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1881706671644213649 · Twitter Post