CVE-2022-25769: ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the…

PriorityP354critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

0.50%

39.1th percentile

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
acquia	mautic	< 3.3.5	3.3.5
acquia	mautic	>= 4.0.0 < 4.2.0	4.2.0
mautic	core	>= 0 < 3.3.5	3.3.5
mautic	core	>= 4.0.0 < 4.2.0	4.2.0
mautic	mautic	< 3.3.5	3.3.5
mautic	mautic	< 4.2.0	4.2.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.