Vulnerability Details CVE-2022-38577
ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.015
EPSS Ranking 70.4%
CVSS Severity
CVSS v3 Score 8.8
References
- http://packetstormsecurity.com/files/168427/ProcessMaker-Privilege-Escalation.html
- https://drive.google.com/file/d/1iP9NYUkYEy_FGMpcnTkUWn8nGcqDT02_/view?usp=sharing
- http://packetstormsecurity.com/files/168427/ProcessMaker-Privilege-Escalation.html
- https://drive.google.com/file/d/1iP9NYUkYEy_FGMpcnTkUWn8nGcqDT02_/view?usp=sharing
Products affected by CVE-2022-38577
-
cpe:2.3:a:processmaker:processmaker:3.0.1.7
-
cpe:2.3:a:processmaker:processmaker:3.4.11