CVE-2022-22108 json
DayByDay CRM - Missing Authorization when Viewing Absences
published 2022-01-05 4 y ago modified 2026-06-17 4 mo ago also GHSA-frxp-xxx8-hrg6 , EUVD-2022-0590
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
Patch / fix
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | bottelet/flarepoint | >=2.0.0, <2.2.1 |
2.2.1 |
Affected products
- Bottelet DaybydayCRM
- Bottelet flarepoint
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/Bottelet/DaybydayCRM/commit/fe842ea5ede237443f1f45a99aeb839133115d8b
web, patch, third-party-advisory
-
whitesourcesoftware.com
/vulnerability-database/CVE-2022-22108
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-22108
advisory
-
github.com
/Bottelet/DaybydayCRM
web
Sources
- CVE List CVE-2022-22108
- GitHub Advisory GHSA-frxp-xxx8-hrg6
- NVD CVE-2022-22108
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.