VULNERABILITY INTELLIGENCE

CVE-2022-22107

CVSS score4.3 MEDIUM

EPSS probability0.70%

CISA KEVNot currently listed

Published2022-01-05

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.

Weakness classification

vulnerabilitylab@mend.io: CWE-862
nvd@nist.gov: CWE-862

Primary references

vulnerabilitylab@mend.io — Patch, Third Party Advisory
vulnerabilitylab@mend.io — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory