CVE-2022-22107 json
DayByDay CRM - Missing Authorization when Viewing Appointments
published 2022-01-05 4 y ago modified 2026-06-17 4 mo ago also GHSA-44gv-fgcj-w546 , EUVD-2022-0437
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Patch / fix
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | bottelet/flarepoint | >=2.0.0, <2.2.1 |
2.2.1 |
Affected products
- Bottelet DaybydayCRM
- Bottelet flarepoint
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661b
web, patch, third-party-advisory
-
whitesourcesoftware.com
/vulnerability-database/CVE-2022-22107
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-22107
advisory
-
github.com
/Bottelet/DaybydayCRM
package
Sources
- CVE List CVE-2022-22107
- GitHub Advisory GHSA-44gv-fgcj-w546
- NVD CVE-2022-22107
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.