CVE-2022-25769

HIGH

7.2

Description

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Details CVE

Score CVSS v3.17.2

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

Vecteur d'attaqueLOCAL

ComplexiteHIGH

Privileges requisHIGH

Interaction utilisateurNONE

Publie9/18/2024

Derniere modification2/27/2025

Sourcenvd

Observations honeypot0

Produits affectes

acquia:mautic

Faiblesses (CWE)

CWE-1284CWE-1284

References

https://github.com/mautic/mautic/security/advisories/GHSA-mj6m-246h-9w56(security@mautic.org)

https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic(security@mautic.org)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.