CVE-2022-25769

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-25769

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-25769.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-25769

Aliases

GHSA-mj6m-246h-9w56

Published

2024-09-18T14:47:09.029Z

Modified

2026-05-01T04:10:40.988376Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H CVSS Calculator

Summary

Improper regex in htaccess file

Details

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Database specific

{
    "cwe_ids": [
        "CWE-1284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25769.json",
    "cna_assigner": "Mautic"
}

References

Affected packages

Git / github.com/mautic/mautic

Affected ranges

Type

GIT

Repo

https://github.com/mautic/mautic

Events

Introduced

Fixed

6b64469b6e1048aee3acb05479bc53c32346933c

Introduced

0abd6b79738f7cf096b435d8f87ea998617e17c1

Fixed

cd19c594208c327b995ac7050f95720d830c3ddd

Database specific

{
    "cpe": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.5"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.2.0"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

1.*

1.0.0

1.0.0-beta2

1.0.0-beta3

1.0.0-beta4

1.0.0-rc1

1.0.0-rc2

1.0.0-rc3

1.0.0-rc4

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.4.0

1.4.1

2.*

2.0.0

2.0.1

2.1.0

2.1.1

2.12.2-beta

2.14.2-beta

2.2.0

2.2.1

2.3.0

2.4.0

2.5.0

2.5.1

2.6.0

2.6.1

2.7.0

2.7.1

2.8.0

3.*

3.0.1

3.1.0

3.1.0-rc

3.3.0-rc

3.3.2

3.3.2-rc

3.3.3

3.3.3-rc

4.*

4.0.0

4.1.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-25769.json"