CVE-2022-22111 json
DayByDay CRM - Missing Authorization when Changing Password
published 2022-01-05 4 y ago modified 2026-06-17 4 mo ago also GHSA-w6rp-4vj7-v2m8 , EUVD-2022-0720
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
Patch / fix
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | bottelet/flarepoint | <2.2.1 |
2.2.1 |
Affected products
- Bottelet DaybydayCRM
- Bottelet flarepoint
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/Bottelet/DaybydayCRM/commit/fe842ea5ede237443f1f45a99aeb839133115d8b
web, patch, third-party-advisory
-
whitesourcesoftware.com
/vulnerability-database/CVE-2022-22111
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-22111
advisory
-
github.com
/Bottelet/DaybydayCRM
package
Sources
- CVE List CVE-2022-22111
- GitHub Advisory GHSA-w6rp-4vj7-v2m8
- NVD CVE-2022-22111
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.