Vulnerability Description
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Acquia | Mautic | < 3.3.5 |
Related Weaknesses (CWE)
References
- https://github.com/mautic/mautic/security/advisories/GHSA-mj6m-246h-9w56Vendor Advisory
- https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mauticRelease Notes
FAQ
What is CVE-2022-25769?
CVE-2022-25769 is a vulnerability with a CVSS score of 7.2 (HIGH). ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the rege...
How severe is CVE-2022-25769?
CVE-2022-25769 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-25769?
Check the references section above for vendor advisories and patch information. Affected products include: Acquia Mautic.