CVE-2022-22110 DayByDay CRM - Weak Password Requirements in Update User

High 7.5 Published 5 Jan 2022 Updated 3 Aug 2024

Weak password requirements in DayByDay CRM allow attackers to easily brute-force user accounts due to insufficient complexity enforcement.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-22110?

CVE-2022-22110 is a high-severity vulnerability in Bottelet DaybydayCRM, published on 5 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.

Weakness: CWE-521

Which versions are affected by CVE-2022-22110?

2 open source packages ship an affected version, including bottelet/flarepoint. It affects 1 product.

Package	Affected	Fixed in
`bottelet/flarepoint` Packagist	From `1.1`	`2.2.1`
`bottelet/flarepoint` Packagist	From `1.1`	`2.2.1`

Products include Daybydaycrm Daybyday Crm.

How do I fix CVE-2022-22110?

Upgrade bottelet/flarepoint to 2.2.1 or later.

Is CVE-2022-22110 being exploited?

There is no known exploitation of CVE-2022-22110 in the wild and no public exploit code.

Sources

Also known as GHSA-96v6-hrwg-p378.