CVE-2022-25777

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-25777
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25777.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-25777
Aliases
Published
2024-09-18T15:13:52.308Z
Modified
2026-07-15T02:06:00.354731662Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Server-Side Request Forgery in Asset section
Details

Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25777.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "Mautic"
}
References

Affected packages

Git / github.com/mautic/mautic

Affected ranges

Type
GIT
Repo
https://github.com/mautic/mautic
Events
Introduced
e8f705b9c1990077aa944ef2aaf5b705591bfe05
Fixed
d1a8dcdf235f5b50bd1e05146a704e0c250c25da
Introduced
96b53794017cde917e1e4262ebaaae5099e3586a
Fixed
4676457f5ac7c9d13308b119a28bbe527cb542ce
Introduced
41ced3a8454de4950c7da4c81291993737783930
Last affected
7f0a26411e8a1d159c6c24061df33d20a2eca7ce
Database specific 
{
    "cpe": [
        "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:acquia:mautic:1.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:acquia:mautic:1.0.0:beta4:*:*:*:*:*:*",
        "cpe:2.3:a:acquia:mautic:1.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:acquia:mautic:1.0.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:acquia:mautic:1.0.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:acquia:mautic:1.0.0:rc4:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "1.0.1"
        },
        {
            "fixed": "4.4.12"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.4"
        },
        {
            "introduced": "1.0.0-NA"
        },
        {
            "last_affected": "1.0.0-NA"
        },
        {
            "introduced": "1.0.0-beta4"
        },
        {
            "last_affected": "1.0.0-beta4"
        },
        {
            "introduced": "1.0.0-rc1"
        },
        {
            "last_affected": "1.0.0-rc1"
        },
        {
            "introduced": "1.0.0-rc2"
        },
        {
            "last_affected": "1.0.0-rc2"
        },
        {
            "introduced": "1.0.0-rc3"
        },
        {
            "last_affected": "1.0.0-rc3"
        },
        {
            "introduced": "1.0.0-rc4"
        },
        {
            "last_affected": "1.0.0-rc4"
        }
    ]
}

Affected versions

1.*
1.0.0-NA
1.0.0-beta4
1.0.0-rc1
1.0.0-rc2
1.0.0-rc3
1.0.0-rc4
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
1.4.0
1.4.1
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.12.2-beta
2.14.2-beta
2.2.0
2.2.1
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.7.1
2.8.0
3.*
3.0.1
3.1.0
3.1.0-rc
3.3.0-rc
4.*
4.0.0
4.0.0-alpha1
4.0.0-beta
4.0.0-rc
4.1.0
4.2.0
4.3.0
4.3.0-beta
4.3.0-rc
4.3.1
4.4.0
4.4.0-beta
4.4.1
4.4.10
4.4.11
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
5.*
5.0.0
5.0.1
5.0.2
5.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25777.json"