From f44877de644a5968fa5055d274be51484de14730 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 18 Sep 2024 17:45:45 +0000
Subject: [PATCH] Publish GHSA-x3jx-5w6m-q2fc

---
 .../GHSA-x3jx-5w6m-q2fc.json                  | 88 +++++++++++++++++++
 1 file changed, 88 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json

diff --git a/advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json b/advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json
new file mode 100644
index 00000000000..246ae6efe67
--- /dev/null
+++ b/advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x3jx-5w6m-q2fc",
+  "modified": "2024-09-18T17:43:36Z",
+  "published": "2024-09-18T17:43:36Z",
+  "aliases": [
+    "CVE-2022-25768"
+  ],
+  "summary": "Mautic vulnerable to Improper Access Control in UI upgrade process",
+  "details": "### Impact\nThe logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.\n\n### Patches\nUpgrade to 4.4.13 or 5.1.1 or later.\n\n### Workarounds\nNone.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@mautic.org](mailto:security@mautic.org)\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "mautic/core-lib"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.1.3"
+            },
+            {
+              "fixed": "4.4.13"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "mautic/core-lib"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.0.0-alpha"
+            },
+            {
+              "fixed": "5.1.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mautic/mautic/commit/89f964d06f00688016b38a56dfd9e95fc676c7ce"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mautic/mautic/commit/925aeee7d3dbb6ca67f92d9dc5893d99250f739b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mautic/mautic"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-09-18T17:43:36Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file